-1

I have a question/problem. I have two webservers. One is a webmail and the other one is a standard webserver. I need to forward 443 port to both of them. I have added proxyarp to the shorewall and added rules like this to the rules file:

WEBMAIL:
    DNAT    net                     loc:INTIP1:443     tcp     443     # scalix web

WEB:
    DNAT    net                     loc:INTIP2:80     tcp     80      -       EXTIP
    DNAT    net                     loc:INTIP2:443    tcp     443     -       EXTIP

But this does not work. If I open the webserver that is redirect to EXTIP on port 80 everything works fine, but if I try to open it using HTTPS it redirects me to the scalix web https. Can anyone help me out how I can forward the ports so both of them can use it.

Or is it impossible to do because its the same port? Would I need to change the SSL port in scalix web or webserver order it to work?

5
  • Wait...i've written an answer but now i have a doubt...your DNAT rules for your Webserver are incoming ones (means from the internet to your local webserver, am i correct or not ? If i am correct, does your Webmail server has to be reachable from the Internet also and from the Lan too ?
    – krisFR
    Feb 21, 2014 at 9:11
  • They both have to be reachable both ways. I think the best way to do it is to be using DMZ in shorewall. Reading about it at the moment. Seems like a easy solution, but never should we say easy.
    – cr0c
    Feb 21, 2014 at 9:28
  • Ok, but there is another thing i cannot understand. If your Webmail and Webserver servers are different machine, why do you use the same INTIP for both ? They should have different IP
    – krisFR
    Feb 21, 2014 at 10:16
  • INTIP is a example. They have different IP's. One is 192.168.x.25 and the other one is 192.168.x.5.
    – cr0c
    Feb 21, 2014 at 11:53
  • ok, so use INTIP1 and INTIP2 instead, because it is confusing for us !
    – krisFR
    Feb 21, 2014 at 11:59

1 Answer 1

1

This is happening because you use the same destination ip address (INTIP) and same destination port (443) for both Webmail and Web, and Webmail rule is matching first.

I would suggest to use a different destination ip address for Webmail, e.g :

# 10.10.10.10 is the NATed ip
# 192.168.1.10 is the real ip of the Webmail server

WEBMAIL:
    DNAT     net    loc:192.168.1.10:443   tcp     443      -      10.10.10.10

Replace 10.10.10.10 by any non-used but routable IP in your Network.


EDIT

After some comments we had, you want to be able to access your servers from both Internet and Lan.

In that case, the most reliable approach, to me, would be to have a secondary public IP address, so that you could NAT the first to your Webmail and the second to your Webserver :

WEBMAIL:
    DNAT    net             loc:INTIP1:443     tcp     443     -       EXTIP1

WEB:
    DNAT    net             loc:INTIP2:80      tcp     80      -       EXTIP2
    DNAT    net             loc:INTIP2:443     tcp     443     -       EXTIP2

In my company we have a /24 range available for public IPs, but i guess not everyone is so lucky ;)


If a secondary IP address is an issue, you could use port-forwarding for the Webserver (or Webmail), to forward, for a sample, port 8443 to port 443 :

WEB:
    DNAT    net             loc:INTIP2:443    tcp     8443    -       EXTIP

However, as you said, you could also change the port for the Webserver or the Webmail.


Another approach would be to use a Reverse Proxy between your servers and your Firewall.

In that case, your Firewall will redirect all requests to your Reverse Proxy, and the Reverse Proxy will redirect traffic to the right server regarding the Host Header.

Not the answer you're looking for? Browse other questions tagged .