How to route outbound traffic to specific domain “XYZ.org” via a specific NIC or public/static IP? [closed]

Question

Within the next week or so, I'll be setting up an AT&T U-verse modem with 5 usable static public IP addresses. I plan to register a domain name pointing at 1 of the 5 static IPs, and run a website from a single server setup in my home LAN.

I'll skip the long winded reason why, but I need to somehow source route outbound traffic (originating from my server) destined for one public domain (i.e. http://www.sample.org) to be from one of the other 4 static IPs only. Basically, I want this public domain to see connections coming from an IP address and not my domain name. If it makes it easier, this can apply to all outbound traffic from my server as long as it doesn't impact users browsing my website! Inbound connections should go through the domain name / registered public IP.

Can I accomplish this with my single server with one or multiple NICs? Do I need multiple servers and set one up as a proxy? Please help as my background is in software and not networking, and I don't think I can accomplish this at the application layer.

Thanks.

=================================

EDIT + ADDITIONAL INFO:

AT&T couldn't tell me the model number of the modem+router, sigh, so I'm trying to get a grasp on this before the equipment arrives. My server will be setup behind the modem+router, not directly connected to the internet, with port forwarding setup on my router to fwd traffic from mywebsite.com. I just want all traffic that ORIGINATES from my server internally to go "out" through 1 of the 4 IP addresses NOT registered to my domain. All inbound traffic from mywebsite.com should reply through the 1 domain registered IP.

I've been mulling over this for hours and have an idea: If I have 2 NICs on the internal server and set them up on separate subnets, can I just setup port forwarding from my website to NIC #1 and add a route to my server to have NIC #2 be the preferred route for all outbound traffic? If I understand this correctly, just b/c NIC #2 has a preferred route, it shouldn't interrupt inbound traffic on NIC #1 on a different subnet... correct? i.e. the inbound traffic headed to NIC #1 won't be replied to on NIC #2, right?

THANKS AGAIN!

Answer 1

What you need to do depends very much on your setup.

First, it is difficult to route traffic based on the destination domain name. However, it is easy to route it based on the destination IP, so you could resolve the IP and create rules based on that (but be aware it may change at any time).

As long as your router is reasonably flexible (I like to use a server running unix in such cases), you can fairly easily create source routing rules; in iptables, for instance, you would use the SNAT target. For example, if your server is directly connected to the internet and has an IP on one of its interfaces, you could create a rule like

iptables -t nat -A PREROUTING -d ${DEST_IP} -j SNAT --to ${PUBLIC_IP_2}

or

iptables -t nat -A OUTPUT -d ${DEST_IP} -j SNAT --to ${PUBLIC_IP_2}

What exactly you end up doing, however, depends on exactly how your server is connected to the internet.

Another solution you could use is to source NAT all of your traffic to come out of one IP, except for (say) http and https traffic originating from your web server, which would come from the IP your DNS name points at.

Answer 2

You can certainly accomplish this, in one of several ways.

If you are using P-NAT (see for more on figuring which nat you use), then use the IP number that you want the third party site to see as your P-NAT address, and use port forwarding to point inbound requests on the server's IP address to the server's internal address.

If the server is directly connected to the internet, add another NIC and connect it to the local network as well. Set the local network's natted IP to be the one you want the third party site to see and add the following routes on the server:

ROUTE 1.2.3.0 MASK 255.255.255.0 ETH0 192.198.1.1 10
ROUTE 0.0.0.0 MASK 0.0.0.0 ETH1 4.5.6.7 10

where 1.2.3.0 is the network that the third party site sits on, eth0 is your internal nic, eth1 your external nic, 192.168.1.1 as your internal gateway and 4.5.6.7 as your external gateway.

If you provide the configuration of your network and the model of your router, we can provide more information.