0

I currently have one hardware linux server with one IP address that is running three websites (virtualhosts via apache). I would like to push each website into its own virtual machine in order to improve isolation/security, and for easier migration to different hardware if the need ever arises. (I am beginning to check into coreos for this purpose.)

but I am baffled by the easy question. how do I push different virtualhost httpd (or ssh or ...) requests to different virtual machines on the same IP hardware?? this is not a DNS-level question---my DNS provider only pushes my visitors to the main IP, me thinks.

advice appreciated.

regards,

/iaw

3

You can set up a proxy server that redirects traffic to the virtual server based on the vhost rules. Apache has mod_proxy for this, you can setup a reverse proxy/gateway that redirects HTTP traffic to the right virtual machine based on the vhost matching.

| improve this answer | |
2

You need a reverse proxy seating on the host machine. there are several good ones. Apache with mod_proxy for example:

<VirtualHost external_IP:80>
 ServerName cust1.dev.domain.com
 ServerAdmin webmaster@cust1.dev.domain.com
 ProxyRequests off
 ProxyPreserveHost on
 ProxyPass / http://192.168.0.100/
 ProxyPassReverse / http://192.168.0.100/
 <Proxy *>
      Order allow,deny
      Allow from all
 </Proxy>
 ErrorLog /var/log/apache2/cust1.dev.domain.com.log
 CustomLog /var/log/apache2/cust1.dev.domain.com.err.log combined
</VirtualHost>

<VirtualHost external_IP:80>
     ServerName cust2.dev.domain.com
     ServerAdmin webmaster@cust2.dev.domain.com
     ProxyRequests off
     ProxyPreserveHost on
     ProxyPass / http://192.168.0.101/
     ProxyPassReverse / http://192.168.0.101/
     <Proxy *>
          Order allow,deny
          Allow from all
     </Proxy>
     ErrorLog /var/log/apache2/cust2.dev.domain.com.log
     CustomLog /var/log/apache2/cust2.dev.domain.com.err.log combined
</VirtualHost>

Or you could do it with nginx:

upstream vm1  {
      server 192.168.1.100:80; #VM1
}

upstream vm2  {
      server 192.168.1.101:80; #VM2
}

## Start VM1 ##
server {
    listen       external_IP:80;
    server_name  www.example.com;

    access_log  /var/log/nginx/log/www.example.access.log  main;
    error_log  /var/log/nginx/log/www.example.error.log;
    root   /usr/share/nginx/html;
    index  index.html index.htm;

    ## send request back to apache1 ##
    location / {
     proxy_pass  http://vm1;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
     proxy_redirect off;
     proxy_buffering off;
     proxy_set_header        Host            $host;
     proxy_set_header        X-Real-IP       $remote_addr;
     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
   }
}

## START VM2 ##
server {
   listen      external_IP:80;
   server_name static.example.com;
   access_log  /var/log/nginx/log/static.example.com.access.log  main;
   error_log   /var/log/nginx/log/static.example.com.error.log;
   root        /usr/local/nginx/html;
   index       index.html;

   location / {
        proxy_pass  http://vm2;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_redirect off;
        proxy_buffering off;
        proxy_set_header        Host            static.example.com;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}
| improve this answer | |
  • thank you. web-only solution, though. +1, but not a full solution. I need some other services, like ssh, too. – ivo Welch Apr 6 '14 at 23:28
0

Different hosts need to have dIfferent IP addresses. You may be able to hack something together with NAT and a proxy server for the websites. SSH would have to be on different ports for each server.

You are far better off assigning proper IP addresses to each server. Hosting websites on seperate servers is a valid justification for requesting more IP addresses.

| improve this answer | |
  • yes, he ideal solution would be for the key hardware server to automatically direct all traffic, any port, to the right VM. apparently, not easy or at least not common. suspect it will be, as virtual solutions like coreos/lxc/... become more common. – ivo Welch Apr 6 '14 at 23:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.