Multiple web-services all running on port 80 with IPTABLES

Question

I'm basically wondering what is best practice when running multiple web-services that all need to be on port 80 without using something like nginx as a proxy. The following solution is actually working but I'm wondering if I'm actually doing this correctly.

Currently I am doing something like this in my iptables:

*filter
-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.1 -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.1 -m tcp -p tcp --dport 8081 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.2 -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -d 1.1.1.2 -m tcp -p tcp --dport 8082 -j ACCEPT

*nat
-A PREROUTING -d 1.1.1.1 -p tcp --dport 80 -j DNAT --to 1.1.1.1:8081
-A PREROUTING -d 1.1.1.2 -p tcp --dport 80 -j DNAT --to 1.1.1.2:8082

I would point my DNS to 1.1.1.1 for foo.com and bar.com would resolve to 1.1.1.2 but both operate on 80 externally.

I greatly appreciate any input/suggestions, I'm currently running CentOS 5.5.

Answer 1

Why wouldn't you just make both webservers (or whatever they are) bind to port 80 on the different IP addresses? (Ab)using iptables in this manner just confuses people (I know, I've worked in an environment that did this; it was painful, annoying, unproductive, and unnecessary).