Redirect all traffic to specified hosts behind NAT

Question

Is there a possibility to redirect all traffic to specified hosts behind NAT?

For example i have a server, a domain "mydomain.com" and 3 hosts behind NAT. I wish to configure 3 subdomains:

host1.mydomain.com
host2.mydomain.com
host2.mydomain.com
and each of them to redirect all ports to specified host in local net.

That redirection should provide funcionality like this:
http://host1.mydomain.com (can be achieved using apache)
ssh [email protected] (???)
and other protocols on diferent ports

Thanks for any help.

Answer 1

This can be done for HTTP and HTTPS with a "reverse proxy" that examines the host-header information in a HTTP request, gets the appropriate content and returns it. Microsoft's ISA (Internet Security and Acceleration) can do this, so can apache/squid on Linux.

For all other ports you have a harder time, because most traffic doesn't include the desired hostname, just a target IP (eg: "I want to SSH to 1.2.3.4" instead of "I want to SSH to host1.mydomain.com)

Mapping specific external ports to internal ports is easy (port 22 -> host1:22, port 23 to host2:22, port 24 -> host3:22 etc) and is sometimes all that is needed.

If you really need to map all ports to different internal servers you will need multiple external IP addresses, which most ISPs can provide (at least if you have a business connection)

Answer 2

apache mod_proxy ?

Answer 3

No, it's not possible to do port forwarding based on DNS name. The domain name is not part of the IP-packet, so there is no way for your router to use this to distinguish incoming connections.

When a remote host connects to host1.mydomain.com it will resolve this name to an IP-adres, which is put in the IP-packet. If host2.mydomain.com resolves to the same IP-adres the constructed packet will look exactly the same as for host1.mydomain.com.

For that reason it is possible when you have multiple IP addresses configured on your server.

Apache can distinguish the incoming domain name, but that is on the application level. In HTTP 1.1 a browser will send the domain name in the HTTP headers, on which apache can filter using Virtual Hosts.