NAT/Firewall/Proxy software solution

nagetech · Post by **nagetech** » Sun Jul 09, 2006 5:12 am

Hello Everyone, got one for you guys.

Ok, here is the scenario. My room mate and I each have our own servers, with our own domain. Each server has our web server and mail server setup on it. What we need is a software solution that allows us to setup a spare PC as a router. But here's the kicker, it needs to be smart enough to know how to forward to each machine using hte same ports.

For example, if someone invokes http://www.domain1.com, the router should be able to pick up that request, and know domain1 is hosted on my server. If someone invokes http://www.domain2.com, it should be able to forward it to his server. We do NOT want to use different ports (i use 80 and he uses 81 for example). The same goes with Mail and what not.

I have tried Kerio Winroute firewall, and though it is a great piece of software, it can not forward in the fashion we need it. The current setup we have now would foce one of us to use a differnet port other than standard. Currently, I am using all the standard ports (such as 80, 25, 110, etc) while he is using 81, 26 and 111, which is kinda annoying.

I hope someone can give us a hand, we would greatly appreciate it.

Thanks in advance.

YARDofSTUF · Post by **YARDofSTUF** » Sun Jul 09, 2006 6:35 pm

space box would be just the router? A crazy newengland cook/network junkie I know swears by IP Cop for router software.

http://ipcop.org/

No clue if it does what you need, but if your looking around at some, I'd check it out. careful though, its very dominant, it'll take over the entire PC, make sure theres nothing on the box you install it to that you want saved.

Nice guide:
http://www.ipcop.org/1.4.0/en/install/h ... ation.html

Post by **YeOldeStonecat** » Sun Jul 09, 2006 7:00 pm

If you need a software solution to run on an old IP..yup, most of the *nix distros out there will allow mutiple aliases on the WAN interface.

IPCop
Smoothwall
Endian
just to name a few.

I'm going to try Endian next...it's based on IPCop..which has a lot of options..but Endian is a bit more modernized on the interface.

nagetech · Post by **nagetech** » Sun Jul 09, 2006 7:03 pm

Thanks for your reply!

So you are saying one of those distros WILL distinguish http://www.domain1.com -> server 1 and http://www.domain2.com -> server?

I was looking at those, and based on the screenshots, was not sure if it could be done. Could you perhaps assist me to some sort of guide that might clearly lay out how its done (in any of those distros) so I can perhaps have an easier time picking which distro to run.

THanks again, ur always a life saver.

Post by **YeOldeStonecat** » Sun Jul 09, 2006 7:29 pm

I've not set it up myself...to test it...but according to their documentation they do, and I just did a quick Google search and I saw plenty of threads on various forums asking what you ask..and *nix router users saying "This does it....blah blah".

My IPCop box is offline now....I'm back on my RV0 router...I'm going to give Endian a shot soon to replace IPCop. So I can't pull some screenshots right now on the web admin to post here.

http://www.the-scream.co.uk/forums/show ... ode=linear

http://muchtall.com/modules.php?name=Ne ... =0&thold=0

http://forums.onforce.com/viewtopic.php?p=12880

nagetech · Post by **nagetech** » Sun Jul 09, 2006 10:36 pm

I have been doing a lot of reading, but find that most people in my position have the luxery of multiple IP address, as I do not. I have not read about any success stories from wsomeone with just one public IP

cyberskye · Post by **cyberskye** » Mon Jul 10, 2006 2:42 pm

Setup any *nix flavor on that box and use it as a reverse-proxy for both domains.

Apache can handle this - if you config it to, it can simply forward requests to the local domains. Might also want to look at squid if you are just planning on using the box as a straight proxy.

I would put a router (even simple linky) between the proxy and the internet - putting a webserver and border-router on the same box is not very secure.

I know this doesn't answer your question directly, but this solves your problem at the application (apache/squid) layer vs. the network layer. Should be transparent to users.

EDIT - I haven't tried this for email. Not sure how to do this via qmail/sendmail/postfix, but I imagine there is a way. If you are running two distinct domains with web and mail, I'd invest in a second IP.

cyberskye · Post by **cyberskye** » Tue Jul 11, 2006 1:16 am

http://www.apacheweek.com/features/reverseproxies

cyberskye · Post by **cyberskye** » Fri Jul 14, 2006 4:23 pm

Ran across this one for squid - may be easier to configure than apache/mod_rewrite

http://squid.visolve.com/squid/reverseproxy.htm