Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a network on which I run multiple servers each dedicated to a given service.

Because most services run on distinct ports I'm currently looking for a way of unifying "all" services into a single "proxy" machine. The idea is to abstract which machine is being accessed but still allow direct connection if needed/requested.

This "proxy" machine has only one network interface which is part of the same network as all the other service providing machines.

I've looked into Routing and NAT but I've so far failed to figure out how to make it work. I tried to achieve this using shorewall but couldn't find clear examples. However I'm not entirely sure this is the best/simplest strategy.

With that said, what would be the best way of achieving this result?

Example case:

Proxy IP     - Listening port - Send requests to   80 (http)
     "         22 (ssh)
     "         3306 (mysql)
     "         5432 (postgres) 
     "         5222 (jabber)

PS: I'm not concerned with the single-point-of-failure nature of the proxy.


share|improve this question
up vote 1 down vote accepted

As Ansgar has said you need to use a reverse proxy, Haproxy can do this and more. with very few resources

Please note:

  • The proxy is now a potential bottleneck
  • It's also a single point of failure ( run two in failover, sepearate switches power, host etc.)

I think Ansgar had intended for you to use DNS SRV records, They allow you to resolve dns entries too ip port.


I would recommend you calculate the combined bandwidth of all services if this is below the maximum throughput of the intended proxy hosts network interface(s) it should be mostly ok, some network IO tuning would probably be required.

share|improve this answer
HAProxy is not what I had in mind but it seems to solve the problem at hands. Do you have any idea of the resource requirements (Memory, CPU) for something like 1-10 requests per second? – Unode Oct 16 '12 at 17:35
Haproxy uses very few resources, And can handle thousands to hundreds of thousands of connections per second on off the shelf hardware, It really does depend on the workload. While the a basic server can handle many connections, your limit will probably be network throughput. – daxroc Oct 16 '12 at 19:29
For example I have haproxy supporting 500 concurrent connections 24/7 on a 512Mb 1 CPU virtual server. The server is under minimal load. 0.1 at peak. But this is for tcp traffic not http. – daxroc Oct 16 '12 at 19:32

You would need to reverse-proxy the connections, which is not supported by all protocols (SSH for instance). Rather than creating this single point of failure, I'd suggest to add service-specific CNAME records pointing to the respective servers in DNS.

share|improve this answer
I don't have control over the DNS infrastructure in the network. This is why I tried to approach the problem using re-routing strategies (without success so far). – Unode Oct 16 '12 at 17:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.