0

I have this situation. There are two servers on my network. I don't know why. It's just the way it has been set up. The first server (Server1) has a local ip of 192.168.0.2 and the second one (Server2) has a local ip of 192.168.0.200. On the router, there is a configuration in port forwarding that a request for port 443 will be forwarded to Server1. However, now I need to host my website on Server2 (I can't host it on Server1) and I bought the ssl certificate and installed it. But any requests for https will be forwarded to Server1 as port 443 is the default one when the router see https. How could I solve this problem? My network team opened a new port for me 4430 so I can access my site using https://www.example.com:4430. However, I don't think it's practical for my users. Is there a configuration in port forwarding that I can set for port 443 on the router to determine which server the request should go to? For example changing the protocol and so on. Thanks.

1
  • Did either answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Jul 23 '17 at 18:19
2

There are basically three possible solutions to this sort of problem all of them have their pros and cons.

  1. Multiple public IP addresses (and a router that can handle those addresses appropriately).
  2. A http proxy, your proxy accepts the connection, terminates the ssl/tls and forwards the decrypted traffic (possibly re-encrypting it) based on the http headers.
  3. A SNI proxy, your proxy accepts the connection but does not decrypt it, it uses the SNI extension in the TLS headers to decide where to forward it to. Downside here is that this only works with modern clients.
1

You have a few options that I know of. In no particular order:

  1. Purchase a second IP address from your ISP. :443 on first ip goes to first server, :443 on second ip goes to second server. This is standard, inexpensive, and easy to configure.

  2. Use a port other than :443 on the first server.

  3. Specify source. For example, if connections to the first server always arrive with source ip 1.1.1.1, then say 1.1.1.1:xx -> outside_ip:443 goes to Server 1. All other connections to :443 go to server 2.

2
  • esafresa your third point is very interesting. Where in the router could I specify the source? – loveprogramming Jun 23 '17 at 3:13
  • This depends on what device is performing NAT. On a Cisco ASA it would look something like... ` nat (outside,inside) source static obj-1.1.1.1 obj-1.1.1.1 destination static outside_ip obj-server1 service https https `. If that doesn't match then you would have the typical NAT / port forwarding specified after. – esafresa Jun 23 '17 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.