2

Let's say that the public address of a NAT router is 200.1.1.2, and on the inside there are three hosts with private addresses 10.1.1.1, 10.1.1.2, and 10.1.1.3 resp. acting as servers. If a HTML-request comes from the Internet with the socket 200.1.1.2:80, how does the router know to which inside-local address to forward the request to?

1
  • 1
    Without additional configuration, the router doesn't have a way of knowing, and therefore drops the inbound packet. To enable it, you would need to configure a Static PAT which maps a specific IP:Port on the outside to a specific IP:Port on the inside.
    – Eddie
    Jan 29 '18 at 19:31
4

There are three ways this is typically done when the outside has a single IP address:

  • Different ports: the outside router would accept TCP packets on say, ports 80, 81, and 82. It directs the packets internally, eg 200.1.1.2:80 -> 10.1.1.1:80, 200.1.1.2:81 -> 10.1.1.2:80 .... Cisco calls this Port Address Translation, and there are endless resources on the web about it.

  • Load balancing: one outside-facing machine 10.1.1.1 gets all the traffic, and has some method of determining the load of the inside machines, and forwards the requests to the least busy of the workers 10.1.1.2 and 10.1.1.3, which each offer the same content. The router just does routing and NAT. Server software is off-topic here, but you could start searching with HAProxy, one of the better known load balancers.

  • Reverse proxy: one outside-facing machine 10.1.1.1 gets all the traffic and is a web server which has branches of its space forwarding to inside machines for different services; again the router just does routing and NAT. For example, you might send /wiki -> 10.1.1.2, /forum -> 10.1.1.3. This method is also used when serving URLs on different domains. Most web server software will do reverse proxy functions, including Apache, though again server software is out of our remit here.

[EDIT] Occasionally you see source address selection, which is sometimes used as an approximation to geolocation for content selection. In this scheme the router sends some traffic to each server depending on the source address. Search Cisco docs for "policy based routing". (Don't do geolocation on a router, do it on the web server where it's much easier and much better.) I've also seen it used for simple load balancing too, one of the few places I've seen "wacky netmasks" do anything useful: eg forward to four servers based on the bottom two bits of the source address. The reason these techniques are rare is because they are generally are a really bad, unmaintainable, idea.

[EDIT 2] Transparent web proxy As pointed out by others, some "routers" also will do non-router functions such as inspect the incoming request and route it according to the URL in the request. Making routing decisions based on upper-level content is considered fine by some and horrendous by others. In general my advice would be to keep routers absolutely as simple as possible, and do upper-level functions with machines dedicated to that task. Most especially if the devices are externally facing.

3
  • Thank you for the quick answer. I still don't get how the router can find the right host if each of all three (10.1.1.1, 10.1.1.2, and 10.1.1.3) is acting as a server with its own services. The router only gets 200.1.1.2:80 as destination...Should a client of, say, 10.1.1.2 know that the HTML port is 81 not 80? Jan 29 '18 at 11:14
  • If it all comes in to the same place eg 200.1.1.2:80 and the router is just a router, then you're right, it can't know which to forward to.
    – jonathanjo
    Jan 29 '18 at 11:20
  • If you're wanting to offer three services behind one external IP address, you have to do it with the ports (ie client goes to 200.1.1.2:81) or reverse proxy, which is generally more elegant.
    – jonathanjo
    Jan 29 '18 at 11:28
2

You must specify router model you have. For Mikrotik exist - https://wiki.mikrotik.com/wiki/Multiple_Web_Servers Maybe you can get something else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.