I have one public ip address that I would like to share among two private networks. To this end I have a first router/firewall and second router/firewall.

Today, the second firewall terminates the public address on one of its ports and provides nating and filtering to one of the private networks, let's call it the second private network.

I now would like to 'highjack' the public ip address with the first router without the second router noticing too much (except changing the default gateway ip address on the second router perhaps). That is, I would like to terminate the public ip address on the first router directly and then redirect traffic to the second router without blocking any ports or anything, as if the second router was terminating the public ip address directly.

Then I would like to use the first router to also make the internet connection through the public ip address available to another private network, let's call it the first private network, hanging off one of the first router's ethernet ports and implementing a firewall there, however with the possibility to have any port from the public ip address available also on this first private network.

Thus, as an example, one scenario that could happen with this setup is that somebody sets up a webserver on the second private network and configures port forwarding of port 80 on the second router/fw to this webserver. At the same time, I configure port forwarding of port 80 on the first router to a webhost on the first network.

So, there is an ambiguity here: somebody connecting to port 80 on the public address, should s/he be directed to the first or second private network?

Could this be resolved somehow? If so, could it be done with the resources described or do I need more network equipment?

How, roughly described, would I set this up practically? For any configuration example, I use Vyatta/Vyos/Edgemax routers if you are familiar with those.

  • 4
    What you are asking is impossible. You cannot forward port 80 to two different internal hosts. Nov 22, 2015 at 20:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 7, 2017 at 14:56

3 Answers 3


If you only need to direct http/https connections to different web servers, then you need a reverse-proxy.

  1. install and configure your reverse-proxy inside your network
  2. make sure your reverse-proxy can contact all your internal networks
  3. redirect the public 80 port to the reverse-proxy
  4. and voilà, you can reach several different web servers from the outside

If you need to share other ports, then you have to find a way to decide why each packet must go in which network. In most case this is very difficult and require to write your own reverse-proxy.

  • One trick that may be useful is that you can redirect "TLS with SNI" connections without knowing or caring about the protocol inside. Jan 5, 2017 at 23:31

If you have a single public address, you can forward one transport protocol/port to one private address. Routing is deterministic, and you want it to not be. It's like having two hosts with the name IP address on the same network; anycast does this, but it uses the routing protocol to deliver the traffic to the closest (as determined by the routing protocol) host.

As your company grows, you need get more public addresses, or you can use a hosting provider.

  • Ok, but how does a hosting provider host multiple homepages behind a single ip address?
    – mregress
    Nov 22, 2015 at 20:51
  • 1
    A hosting provider would not have a single IP address for two servers. Each server would have a unique IP address in the block of addresses which the hosting provider owns. Get your own block of public IP addresses, or use some other company's block of public IP addresses by hiring that company to host your servers. IP was designed for each host to have a unique IP address. NAT breaks this, but even NAT can't do what you want.
    – Ron Maupin
    Nov 22, 2015 at 20:55
  • 1
    A hosting provider hosts multiple homepages behind a single IP address, not because a single server has multiple addresses, but because the HTTP header contains the "Host" request-header, which includes the domain name of the requested website. So, it's not two hosts with the same address but the same host that servers two Web sites because the browser includes this information in the request. In fact, an HTTP/1.0 server was not able to serve multiple websites. It was until HTTP/1.1 when the "Host" header was introduced that servers were able to do virtual hosting.
    – alvarezp
    Dec 1, 2015 at 15:08

There is no generic solution to this.

Some application protocols, such as http, or tls with the sni extension provide details of the requested hostname as part of the application protocol.

Unfortunately attempting to perform network address translation of traffic based on this information is not possible due to a chicken and egg issue. In order to see the application protocol request a TCP session must first be established. Part of establishing the TCP session is establishing the initial sequence numbers.

This means that the gateway needs to accept the TCP connection in order to determine what hostname the client is requesting, but having done that it can no longer use routing or nat to redirect the traffic. If it wants to redirect the traffic it must proxy it at a higher level as the TCP sequence numbers on the gateway<->server connection will almost certainly not match those on the client<->gateway connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.