Let's say that the public address of a NAT router is 200.1.1.2, and on the inside there are three hosts with private addresses 10.1.1.1, 10.1.1.2, and 10.1.1.3 resp. acting as servers. If a HTML-request comes from the Internet with the socket 200.1.1.2:80, how does the router know to which inside-local address to forward the request to?
asked Jan 29, 2018 at 10:18
-
1Without additional configuration, the router doesn't have a way of knowing, and therefore drops the inbound packet. To enable it, you would need to configure a Static PAT which maps a specific IP:Port on the outside to a specific IP:Port on the inside.– EddieCommented Jan 29, 2018 at 19:31
Add a comment
|
2 Answers
There are three ways this is typically done when the outside has a single IP address:
Different ports: the outside router would accept TCP packets on say, ports 80, 81, and 82. It directs the packets internally, eg 200.1.1.2:80 -> 10.1.1.1:80, 200.1.1.2:81 -> 10.1.1.2:80 .... Cisco calls this Port Address Translation, and there are endless resources on the web about it.
Load balancing: one outside-facing machine 10.1.1.1 gets all the traffic, and has some method of determining the load of the inside machines, and forwards the requests to the least busy of the workers 10.1.1.2 and 10.1.1.3, which each offer the same content. The router just does routing and NAT. Server software is off-topic here, but you could start searching with HAProxy, one of the better known load balancers.
Reverse proxy: one outside-facing machine 10.1.1.1 gets all the traffic and is a web server which has branches of its space forwarding to inside machines for different services; again the router just does routing and NAT. For example, you might send
/wiki-> 10.1.1.2,/forum-> 10.1.1.3. This method is also used when serving URLs on different domains. Most web server software will do reverse proxy functions, including Apache, though again server software is out of our remit here.
[EDIT] Occasionally you see source address selection, which is sometimes used as an approximation to geolocation for content selection. In this scheme the router sends some traffic to each server depending on the source address. Search Cisco docs for "policy based routing". (Don't do geolocation on a router, do it on the web server where it's much easier and much better.) I've also seen it used for simple load balancing too, one of the few places I've seen "wacky netmasks" do anything useful: eg forward to four servers based on the bottom two bits of the source address. The reason these techniques are rare is because they are generally are a really bad, unmaintainable, idea.
[EDIT 2] Transparent web proxy As pointed out by others, some "routers" also will do non-router functions such as inspect the incoming request and route it according to the URL in the request. Making routing decisions based on upper-level content is considered fine by some and horrendous by others. In general my advice would be to keep routers absolutely as simple as possible, and do upper-level functions with machines dedicated to that task. Most especially if the devices are externally facing.
answered Jan 29, 2018 at 11:10
-
Thank you for the quick answer. I still don't get how the router can find the right host if each of all three (10.1.1.1, 10.1.1.2, and 10.1.1.3) is acting as a server with its own services. The router only gets 200.1.1.2:80 as destination...Should a client of, say, 10.1.1.2 know that the HTML port is 81 not 80? Commented Jan 29, 2018 at 11:14
-
If it all comes in to the same place eg 200.1.1.2:80 and the router is just a router, then you're right, it can't know which to forward to. Commented Jan 29, 2018 at 11:20
-
If you're wanting to offer three services behind one external IP address, you have to do it with the ports (ie client goes to 200.1.1.2:81) or reverse proxy, which is generally more elegant. Commented Jan 29, 2018 at 11:28
You must specify router model you have. For Mikrotik exist - https://wiki.mikrotik.com/wiki/Multiple_Web_Servers Maybe you can get something else.
