Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have three EC2 instances. I'd like to route all http requests to one machine and all ssh traffic on the standard port to another. The third machine will be used for routing, but only has one interface: eth0. The idea is that the user gets a single endpoint URL for both http and ssh requests. Right now I have to use a subdomain for the ssh box, which makes commands quite long.

Is there a way to set this up with IPTables? I've tried to set this up with a forward rule, but when trying to ssh in via an external network, the connection times out.

share|improve this question
Ho< did the forward rule you tried look? – Bart De Vos Jun 20 '11 at 8:04

Port forwarding is usually done for machines that are hidden behind a firewall and not otherwise directly accessible. In order to work properly, it requires some form of NAT, which by the sounds of it isn't going to be there in your case. That will make such a setup very awkward.

Effectively you would need to make it such that the router is the only public IP address used, and the other two machines, despite having perfectly usable public IP addresses, are logically arranged behind the router. This can be achieved by setting their default gateway to the IP of the router (i.e. all outgoing traffic goes through the router). Then define DNS entries pointing at the router, and set up the router to perform the necessary forwarding of traffic, complete with NAT.

As long as your router isn't configured properly, I would be very careful with setting the default gateway of the other two machines, since as soon as you do that and the router hasn't been configured to forward traffic properly, you'll lose all connection and the only way to get a working connection will be to ssh into the router and then from there ssh into any of the other machines.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.