2

I hope I'm on the right website as it is my first question here!!

So here is my situation I have a small server hosted at home behind a DSL line for which I have a static IP. Now I would like to have two different services running on the same port. I cannot apply any kind of source IP filtering as they should both be accessible from anywhere. So basically I think there is no way to do that and the only solution is to run the services on 2 different IP addresses.

In order to do that, I was thinking about using another DSL line for which I have obviously a second public IP. Is there any way to redirect the traffic addressed to a specific port to another machine, but on the Internet, not inside the LAN ???

Ah of course, I was hoping to do that just with the modem/router, without any extra hardware (otherwise it would be too easy, some sort of netcat piping and here we go !!). For those interested the router is a Zyxel P-2602R-D1A (link text)

Any ideas and suggestions welcomed !!!

Thanks

0

4 Answers 4

1

In theory, this will work. You will have to setup a port forwarding from the extra public IP to the original IP. In your case, extraIP:80 to originalIP:81.

I have such a setup with iptables. It was designed to ease migration between to IP different public IP ranges. Basically, the "old" public IP would be NATed to the "new" public IP. The NAT went through the Internet without a problem.

I doubt it will work with you modem/router. It is most likely only able to do port forwarding to IP on it's LAN. The only way to find out is to try to NAT any random public IP and you will see if it works.

I have tried with pfense to do this and have failed. Only IPTables has worked correctly.

3
  • That's what I fear too, that it will only forward to hosts on the LAN, but thanks for the suggestion, I'll give it a try. Who knows? maybe this will do the trick!!
    – Federico
    Feb 12, 2010 at 17:48
  • After a few tests, it seems that this solution is not working... Do you think something involving static routes could help (random guess)??
    – Federico
    Feb 12, 2010 at 18:24
  • nope I don't see what you would need to route as their is no extra routing taking place. You should consider inserting a small Linux box or DD-WRT. Feb 12, 2010 at 20:48
0

You have to do add DNAT rule on the router B. That means that the router B has to support DNAT and be flexible enough to do DNAT on the same interface. If not try to install an alternate firmware like OpenWrt.

0

It's possible but tricky, I doubt your average home router will have the flexibility you need to do it.

In the rest of this post I will assume your routers are generic linux boxes. The principles will likely apply on other platforms but I do not know specifics.

In iptables "DNAT" rules are used to change the destination of connections. Iptables will happilly change the destination to anything you want.

This works great when the targets of your DNAT rule are on a LAN behind the router implementing the DNAT. DNAT changes the destination on the initial packet of the connectoin, sets up a connection tracking entry and passes the packet on to the destination. The reply comes back through the same router, matches the conection tracking entry, gets reverse-translated and sent back to the source. The source accepts the packet and communication continues.

It doesn't work so great when the target of your DNAT rule is on a different network somewhere on the internet. DNAT changes the destination on the initial packet and passes the packet back out to your ISP.

If your ISP is following best practices their ingress filtering drops the packet on the floor at this point, but lets pretend they don't.

The packet gets delivered to the server, which replies to it and sends the reply to the client. Unfortunately the reply packet never hits the router implementing DNAT and never gets reverse-translated. So the client gets a packet with an unexpected source address which it promptly drops on the floor.

So how do we get around this?

One option is that in addition to passing the packet through a DNAT rule we also pass it through a SNAT/MASQUERADE rule. This will avoid problems with ISP ingress filtering and will bring the replies back to the NAT box so reverse-translations can be applied. Unfortunately it will also hide the IP of the client from the server making abuse control virtually impossible.

The other option is to combine a VPN with policy routing. Rather than sending the packets from NAT box to server over the open Internet we send them over a VPN. Then on the server policy routing is used so that when a packet comes in over the VPN replies to that packet are also sent over the VPN.

-1

Now I would like to have two different services running on the same port

You can't do it that way. Each server program has to be listening on it's own port (you will encounter "can't bind" or "port in use" errors if you have two programs try to open the same port).

If you're talking about hosting two different web sites, that's accomplished by name-based virtual hosting. I.e., one server listens on port 80, but requests for site 1 and site 2 go to different places.

Other than that, you'll need two public IP addresses or you'll need to use different ports.

I'm sure your ISP would be happy to sell you another IP address. You might have to get a different DSL router (I don't know if yours knows how to handle more than one public IP), but you won't need another DSL line.

3
  • You should really read carefully his question. He mentions that he knows it isn't possible to have two services on the same port. Feb 12, 2010 at 17:36
  • Yes sure, that's obvious! To clarify things up, the setup would be: Service 1 running on public_IP_A:port_X Service 2 running on public_IP_A:port_Y And then my problem is how to have my router redirecting: public_IP_B:port_X --> public_IP_A:port_Y
    – Federico
    Feb 12, 2010 at 17:38
  • The 2 programs can listen on the same port on the same machine as long as the 2 programs are listening on different TCP sockets (read as protocol/IPaddress:port pairs). So if the IPs are different they can listen on the same port. And even if they have the same IPaddress and port, but they are listening on two different protocols (UDP, TCP) it is ok. Feb 12, 2010 at 17:41

You must log in to answer this question.