Hi everyone,

I have been beating my head for the last few weeks on this problem, (although I have been taking the wrong approach, it seems).

I need a gateway to direct web traffic to three separate servers/domains. I have been trying to do this with both a dns server and , (seperatly), apache server to forward requests. The dns server was a no go, and <i can only get apache to redirect http and ftp.

After Googling this ALOT, I believe that what I need is a gateway server to redirect my traffic to the 3 different servers. I have been reading about using using nat and iptables for this and was wondering if anyone had any advice/suggestions on this. The other thought I had was to use something like pfSense to create the gateway, but I am still reading the documentation, and I am unsure if this approach will work.

Any thoughts, suggestions ect. would be highly appreciated.

Thanks

zog

I don't see why you couldn't use nat and iptables for this. What issues are you running into exactly and what makes you believe this can't be done via iptables? How is your network laid out?

Hi rweaver,

The reason I am unsure is that I would need to redirect A LOT pf ports. What I have read is that iptables won't allow 2 machines to use the same port, (http can be port 80 for one machine, but not for two). Here is an excerpt of my iptables rules:

## Accept ftp-data and ftp (ports 20 & 21)
iptables -A INPUT -p tcp -m tcp --syn --dport 20 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --syn --dport 21 -j ACCEPT

## Accept ssh (port xxxxx)
iptables -A INPUT -p tcp -m tcp --syn --dport xxxxx -j ACCEPT

## Accept smtp (port 25)
iptables -A INPUT -p tcp -m tcp --syn --dport 25 -j ACCEPT

## Accept dns (port 53)
iptables -A INPUT -p udp -m udp -s 0/0 --dport 53 -d 0/0 -j ACCEPT
iptables -A INPUT -p tcp -m tcp -s 0/0 --dport 53 -d 0/0 -j ACCEPT

## Accept http (port 80)
iptables -A INPUT -p tcp -m tcp --syn --dport 80 -j ACCEPT

## Accept http (port 8080)
iptables -A INPUT -p tcp -m tcp --syn --dport 8080 -j ACCEPT

## Accept pop3 (port 110)
iptables -A INPUT -p tcp -m tcp --syn --dport 110 -j ACCEPT

## Accept inbound identd (port 113)
iptables -A INPUT -p tcp -m tcp --syn --dport 113 -j ACCEPT
## or you can reject and send back a TCP RST packet instead
#iptables -A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset

## Accept imap (port 143)
iptables -A INPUT -p tcp -m tcp --syn --dport 143 -j ACCEPT

## Accept https (port 443)
iptables -A INPUT -p tcp -m tcp --syn --dport 443 -j ACCEPT

## Accept smtps (port 465)
iptables -A INPUT -p tcp -m tcp --syn --dport 465 -j ACCEPT

## Accept msp (port 587)
iptables -A INPUT -p tcp -m tcp --syn --dport 587 -j ACCEPT

## Accept SpamAssassin (port 783)
iptables -A INPUT -p tcp -m tcp --syn --dport 783 -j ACCEPT

## Accept imaps (port 993)
iptables -A INPUT -p tcp -m tcp --syn --dport 993 -j ACCEPT

## Accept pop3s (port 995)
iptables -A INPUT -p tcp -m tcp --syn --dport 995 -j ACCEPT

## Accept Webmin
iptables -A INPUT -p tcp -m tcp --syn --dport xxxxx -j ACCEPT

As you can see, it would be a lot of work to reconfigure each server to use a different port for each service. As I am using qmail, I am not sure if it can be done for all of the services that I need without causing problems.

What I was hoping for was something that would be some what "seamless", that could just redirect the traffic without requiring 20 different services to be reconfigured.

Thanks

zog

I may be missing something, but it is not clear exactly what you are trying to achieve. I am right when I say the following:

You have 3 servers sitting behind some sort of gateway/firewall and you want each server to serve HTTP, SMTP and POP3 for a different distinct domain. Do you only have a single public IP address or do you have several?

Hi nonamenobody,

Yes, currently I have 3 servers that use DNS2Go for their external connections, (my ISP uses dynamic IP's, not static), that are behind a Smoothwall 3.0 firewall. I can set all of the machines on the DMZ, however, I need to direct the traffic to each different machine, (i.e traffic for example.com going to example.com and not example.net).


All I need is something that will direct my traffic as it comes past the Smoothwall firewall to the correct machines. It must be able to handle all of the services that I need.

Originally, I had wanted to setup a DNS server, which I thought would deal with the problem, however I had trouble with setting the external IP since it changed constantly. Currently, I am trying to setup a DNS server with DNS2GO's IP's. I will post up if that works.

I am also reading to see if it is possible to redirect the ports on the three servers to achieve the same thing with NAT and iptables. It would be a lot of work, but if I can set it up as a script it might be doable. Ultimately, I just need it to work and be secure, so I am not to picky of how to do it.

Sorry if this is overly verbose, but I wanted to give as much info as I could.

Thanks

zog