Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and added rules like this to the rules file:

    DNAT    net                     loc:INTIP1:443     tcp     443     # scalix web

    DNAT    net                     loc:INTIP2:80     tcp     80      -       EXTIP
    DNAT    net                     loc:INTIP2:443    tcp     443     -       EXTIP

But this does not work. If I open the webserver that is redirect to EXTIP on port 80 everything works fine, but if I try to open it using HTTPS it redirects me to the scalix web https. Can anyone help me out how I can forward the ports so both of them can use it.

Or is it impossible to do because its the same port? Would I need to change the SSL port in scalix web or webserver order it to work?

share|improve this question

closed as off-topic by MadHatter, Katherine Villyard, mdpc, Falcon Momot, TheCleaner Feb 26 '14 at 19:25

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – mdpc, TheCleaner
  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – MadHatter, Katherine Villyard, Falcon Momot
If this question can be reworded to fit the rules in the help center, please edit the question.

Wait...i've written an answer but now i have a doubt...your DNAT rules for your Webserver are incoming ones (means from the internet to your local webserver, am i correct or not ? If i am correct, does your Webmail server has to be reachable from the Internet also and from the Lan too ? – krisFR Feb 21 '14 at 9:11
They both have to be reachable both ways. I think the best way to do it is to be using DMZ in shorewall. Reading about it at the moment. Seems like a easy solution, but never should we say easy. – mYzk Feb 21 '14 at 9:28
Ok, but there is another thing i cannot understand. If your Webmail and Webserver servers are different machine, why do you use the same INTIP for both ? They should have different IP – krisFR Feb 21 '14 at 10:16
INTIP is a example. They have different IP's. One is 192.168.x.25 and the other one is 192.168.x.5. – mYzk Feb 21 '14 at 11:53
ok, so use INTIP1 and INTIP2 instead, because it is confusing for us ! – krisFR Feb 21 '14 at 11:59

This is happening because you use the same destination ip address (INTIP) and same destination port (443) for both Webmail and Web, and Webmail rule is matching first.

I would suggest to use a different destination ip address for Webmail, e.g :

# is the NATed ip
# is the real ip of the Webmail server

    DNAT     net    loc:   tcp     443      -

Replace by any non-used but routable IP in your Network.


After some comments we had, you want to be able to access your servers from both Internet and Lan.

In that case, the most reliable approach, to me, would be to have a secondary public IP address, so that you could NAT the first to your Webmail and the second to your Webserver :

    DNAT    net             loc:INTIP1:443     tcp     443     -       EXTIP1

    DNAT    net             loc:INTIP2:80      tcp     80      -       EXTIP2
    DNAT    net             loc:INTIP2:443     tcp     443     -       EXTIP2

In my company we have a /24 range available for public IPs, but i guess not everyone is so lucky ;)

If a secondary IP address is an issue, you could use port-forwarding for the Webserver (or Webmail), to forward, for a sample, port 8443 to port 443 :

    DNAT    net             loc:INTIP2:443    tcp     8443    -       EXTIP

However, as you said, you could also change the port for the Webserver or the Webmail.

Another approach would be to use a Reverse Proxy between your servers and your Firewall.

In that case, your Firewall will redirect all requests to your Reverse Proxy, and the Reverse Proxy will redirect traffic to the right server regarding the Host Header.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.