Imagine I have multiple (debian) servers in different locations which are not connected via LAN.

I need to find a way to forward specific ports to one of the other servers but the server which handles the request should see the original IP of the user who connected to the forwarding server. I know there is X-Forwarded-For for HTTP, but I am interested in TCP in general.

It's also possible to setup a VPN (openvpn, PPTP, ...), I don't know if this helps but the problem with VPN is that then all cross-server connections will go through the VPN host but it would be better if every server can forward traffic directly to another one.

I mean: server1:80 => server2:80
server2:8080 => server3:8080
server3:1234 => server1:1234

I tried SSH-forwarding but the original IP gets lost.


Hard to fit your exact needs, but one possiblity you could experiment with is:

  1. Set up VPN tunnels from Server to Server. This fixes your complaint about VPN.
  2. Run HAProxy using the TProxy patch. This can make generic TCP proxies and keep the original IP intact. With this one caveat is that all replies must be routed through the load balancer. This traffic could than go through the VPN tunnels.

Your requirements are quite specific, you might getter better advice from us if take a step back and explain what you are trying to architect with a little more detail.


Once you start forwarding the packets from server to server you're doubling the load on the network. Why not set up your router/firewall to redirect the packet based on destination port so that it goes to the correct server in the first place? Then the router/firewall would handle switching destination addresses back and forth.

The reason the "and forth" is needed is because if a client thinks it is connecting to server1, the packets coming back must be coming from server1's IP address or the client will ignore them, so when server3 responds, the "from" address needs to be changed to server1, which the firewall should handle automatically if it's using something like Linux's ip_conntrack for the NAT.

If you insist on forwarding back and forth between the servers, I've got a few ideas but no way to test them right now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.