Hi everyone,

I am questioning whether I need to keep paying for 5 static IPs. The only reason I have all 5 of them is because we host multiple web servers and I use a different public IP on the firewall (Ubuntu Server) to port forward to the right server.

Is it possible to use use IPTables to check what URL a connection is coming in for and route accordingly? I use Shorewall and would like to use this to do it if it is possible. I don't even know if this is an IPTable thing or some other tech. is needed.

Thanks.

Assuming you are hosting with Apache and all 5 servers are virtualized on the Ubuntu box, could you not use mod_rewrite with RewriteCond and RewriteRules to forward to particular web sites?

The Websites are on 3 dedicated servers behind the firewall. I DNAT 1 Public IP for each server.

What I was hoping to do was to use 1 public IP and on the firewall DNAT to the correct web server based on the domain / URL coming in. Each server does have Apache and a few sites on it. I just wanted to see if I can go down to 1 Public IP for these 3 servers and DNAT based on the incoming URL / domain.

Any ideas?

If the ubuntu box is the public server it must be your DMZ. I would think you could internalize the other servers (10. or 192. space addresses) and tightly limit the ports from the firewall to the internal web servers. DNAT sound like a perfect way to go.

I am already doing that. I have all servers behind the firewall. The problem is all 3 of them listen on port 80 which means I have to DNAT 3 Public IP's to these servers.

What I was hoping to do is detect what URL a person is coming in on (on the firewall) and based in that URL DNAT to the proper web server behind the firewall. If I can do this then I can just use 1 public IP and DNAT to the right web server behind the firewall. The thing holding this plan up though is that I don't know how to do this.

I believe Microsoft's ISA server can do this and am sure Linux has an equivalent (probably better) way of doing the same thing.

Hopefully I am explaining what I am trying to do properly.

Thanks.

You can setup squid as a reverse proxy with multiple webservers behind it.
http://wiki.squid-cache.org/ConfigEx...fc9490cce5940a