1

Hey guys (first post, wooo!)

I’m a little new to this, but here goes!

Here’s what I’m trying to do… We’ve got multiple servers running and what I’m looking to do is to use 1 external IP address essentially and map the external IP address to many internal servers.

So a user might goto “intranet.mysite.com” which would have an external IP address of 21.21.21.11 and be brought to a sharepoint site, which would be running on a server internally.

Then, another user might go to “support.mysite.com” which would have the same external IP address as above but would be brought to a support site of some kind, once again running on a different server within the local network.

Should I be looking into ACL lists, PAT, NAT, some form of IIS host headers? Or should I even be hosting services like these in an internal network instead hosting them in a DMZ. I’m really quite stumped on this issue (I suppose it’s not really an issue but it’s something that I’d like to understand)

If I can help it, I’d prefer not to have domains such as “intranet.mysite.com:92” and things of the like - either way, I’m interested to hear what you guys have had to deal with in terms of, whatever the heck I’m talking about.

Apologies in advance if this topic has been covered somewhere else on SpiceWorks.

6 Spice ups
2

I think you will need some kind of publishing system. Something like Microsoft ISA would allow you to publish multiple internal web servers with only one static public IP address.

3

You can of course have multiple server behind a single WAN IP but, you may run into an issue. Host headers would be a good option however, the multiple sites would need to be hosted on the same web server. If not then you are going to have to configure the service to run on different ports which you have already mentioned you don’t want. Can you not combine some of these sites on the same server?

1 Spice up
4

You arw looking for reverse proxy. Look at router on a srick solution like pfsense and add squid with reverse proxy capability.

1 Spice up
5

Would a reverse proxy do what you want?

6

Yes, you’ll either need to run your sites on different ports, and have those ports forwarded by your firewall to the correct resource internally, or use a proxy with host header filters, like Squid or HAProxy or…

2 Spice ups
7

… or Apache
http://stackoverflow.com/questions/9316683/apache-host-header-proxy

Any one of these options should work. You will want to test before going live of course.

1 Spice up
8

I’m with Kyle - Custom ports that redirect with SNAT to an internal server

Good suggestion

9

Thanks for the comments everyone :slight_smile: - I’ll take a look at some of the reverse proxy options.

10

Would it work if he had layer 3 switch (router) running dd-wrt hooked straight to the static ip. Could the router look at the headers and forward them correctly

11

paul cartwright wrote:

Would it work if he had layer 3 switch (router) running dd-wrt hooked straight to the static ip. Could the router look at the headers and forward them correctly

While this sort of a solution might work (though you would not be looking at layer 3 or layer 4 headers). This solution would be fragile and difficult to maintain. Stick with the solutions that were designed for this problem.

12

I have had success setting up HAproxy along with SQUID on pfsense. I hope you find a solution that works best for your environment.