I have a RedHat 7 server and a couple of Ubuntu KVMs. The guest vms are connected using NAT because we do not have any public IP addresses to spare at this moment.

Is it possible to use iptables to route traffic from host port 443 to route to all the vms?

I already have iptable rules to route ssh from outside ip address directly to the vms. I am assuming because I'm routing a dedicated port number for each VM, that it is not possible to route a single host port to all of my vms.

The default incoming and forwarding is set to deny.

  • You can't route to 'all' the VMs with iptables, only one! – Michael Hampton Feb 1 at 21:47
  • I thought that that might be the case. Just was wondering if someone knew of a way to get around this. – jimbob Feb 1 at 21:54
  • 1
    Sure, run HAProxy with SSL passthrough. – Michael Hampton Feb 1 at 22:05

I have a similar setup in my home lab. I’ve forwarded relevant ports from the Internet to a VM running HAProxy, which then reads host headers from incoming traffic to forward it to the correct backend VM/container.

Note that at least for HTTPS traffic you don’t necessarily need to use the same certificate between the client and the HAProxy, and the HAProxy and the backends. This simplifies using LetsEncrypt to automatically renew TLS certs while keeping traffic encrypted in transit.

  • This is a very good answer, +1 – Timothy Frew Feb 2 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.