0

I am using an Ubuntu 12.10 server as a router/NAT for an internal network to the internet. I have also configured the server to forward port 80 to a server sitting on my internal network. This all works fine.

What I would like to do now is setup additional port forwarders to addition web servers using port 80 on my network. I have several other static internet addresses I can use externally and just need to setup forwarding to the local servers.

I know I could just create additional Ubuntu servers, configuring each of them with different internet addresses (as well as local addresses on a 2nd NIC) and setting up port forwarding.

Is this possible to do with a single Ubuntu server?

I tried adding more virtual NICs to my single Ubuntu server but ran into routing problems since all these additional NICs were on the same internet subnet.

Is setting up individual ubuntu servers for each port forward I wish to do the only way to accomplish this?

2 Answers 2

1

What you are asking to do is not possible (that I know of) with NAT. There is really no way for iptables to know where to send what traffic and you can port forward only one instance of post 80.

Imo am more elegant solution is to use nginx as a reverse proxy.

See:

https://help.ubuntu.com/community/Nginx/ReverseProxy

http://bostinno.com/channels/nginx-as-a-reverse-proxy-with-wordpress/

It works well as nginx is fast, light weight, and you can forward to your various servers based on url ;)

Nginx serves out the static content very fast and apache serves out the dynamic content (usually php) very fast (see the second link).

1

if you've got specific external ips for specific internal http servers you can use iptables for NATing to the right one, like this.

Lets supose you've got a inner http servers with ips 10.10.10.2, 10.10.10.3 and 10.10.10.4 and everytime the external ip 50.35.100.10 calls port 80 you want it to go to the 10.10.10.2 server so you use the DNAT rule like this

iptables -t nat -A PREROUTING -i eth0 -s 50.35.100.10 -p tcp --dport 80 -j DNAT --to 10.10.10.2

and the rules keep the same for other. Now if you have no specifications like this, as bodhi.zazen said before, there is no way to do it with iptables only.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .