up vote 1 down vote favorite
share [g+] share [fb]

I need opinions and examples on how to best to accomplish the setup I am looking for.

I have a public-facing AD domain server with one public IP address. I have setup an external zone for example.com and I successfully have my own name servers pointing to it at ns0.example.com and ns1.example.com. I also have an internal zone for my private network at home.example.com. I am behind a router with the domain server in the DMZ.

I want dev.example.com to be accessible from the outside world over https and to point to internal IP address 192.168.1.78. Likewise, I want www.example.com to be accessible from the outside world and point to internal IP address 192.168.1.79. Both dev and www servers are CentOS 5.6 VMs running inside of Hyper-V on the domain server (bad idea I know but I am limited on hardware atm).

What is best way to achieve this? From what I have read and researched on Google, I may need to setup a reverse proxy but I am not sure how well that will work with SSL.

link|improve this question
2  
"Domain server" = "domain controller" ? If so, bad idea, don't do this, especially if you're using Windows DNS which doesn't allow you to present different zone information to different networks. – TristanK Apr 15 '11 at 0:53
Yeah DC. I guess I am still getting the terminology down. I know it is bad but this is only an experiment for learning purposes. If I had the money and hardware, I would have separate boxes with their own external IP addresses for the servers and the DC but I don't. – Blu Dragon Apr 15 '11 at 2:23
This sounds a whole lot like it's your home network, not a professional network. You are correct that you'll need to setup a reverse proxy, the ssl cert needs to have both (or all) domain names. – Chris S♦ Apr 15 '11 at 2:56
Yeah I would never consider this in a "professional environment." Thanks! Any good info on doing reverse proxy through IIS? – Blu Dragon Apr 15 '11 at 3:02
Looks a reverse proxy using something like ARR might be the only way to do this. – Blu Dragon Apr 15 '11 at 3:17
show 2 more comments
feedback

3 Answers

up vote 0 down vote

you will need one public ip address per SSL site. you will get a cert error on the site if you have two different SSL site on same IP address. In you firewall you will NAT these address and put the public ip into DNS. dev nat will be 192.168.1.78 nat to one public IP.

link|improve this answer
I'm using a self generated wildcard cert so I'll look into user's suggestion. – Blu Dragon Apr 15 '11 at 6:12
2  
NAT has little to do with IP Forwarding/Mapping; you can run two different SSL sites on the same IP without errors too. – Chris S♦ Apr 15 '11 at 13:07
feedback
up vote 0 down vote

When you have two websites using the same IP and same port on different servers, you can handle the distribution of requests to each server using a reverse proxy like you had mentioned. For that I would suggest using Squid. Here is a guide to use if you are configuring the websites with a wildcard cert. Squid Reverse Proxy with SSL

You can also do some fancy stuff with Mod-rewrite on one of your Apache servers to direct traffic

link|improve this answer
feedback
up vote 0 down vote

You say you are behind a router and that the AD is in DMZ. In this case all you need to do is an DNAT an incoming port 80 request to 192.168.1.79 and DNAT an incoming port request of 443 to 192.168.1.78. Based on the router you use you have to set this up.

or

Let all the connection come to the AD and then using IIS do some kind of redirect. I am not well versed with IIS.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.