One External to Multiple Internal IPs

Wow its been a while since I have posted. But anyway I have a little question for any of you out there who might be able to answer it.


Let me give a sinario,

Lets say I have 1 external IP but run 50 servers within my network all on internal IPs, is there any way to bind each server to a subdomain so that it can be accessed via that subdomain.

Lets say 3 of these machines run SSH, and I dont want to change the port numbers that the service runs on but just make box1.domain.org go to box1's SSH, box2.domain.org go to box2's SSH etc.

If this is at all possible I would like some feedback. If not then screw it.

you can remap ports on a nat firewall, such as Netfilter
lets say all servers will get same ip address (at internet)
but you assign diferent ports (at internet)
at nat firewall you say (suposing that ur ip address on internet is 204.1.1.1)

204.1.1.1:5000 ---> box1:ssh
204.1.1.1:5001 --> box2:ssh
204.1.1.1:5002 --> box3:ssh

you should specify port at internet side, but when packet traverse firewall it will go to the correct port

is that what you want?

Buy a firewall with NAT

cacosapo: I dont think i fully understand you. Would the external address still be box1.domain.org:22 ??

The whole point is that anyone on the outside cant really even notice any difference, if they want to go to the ftp of box1 they just go to any ftp client and put box1.domain.org, and they can do the same for box 2 without the enduser having to change any ports.

I dont see that possible w. a NAT firewall, or maybe im just mistaken.

I dont even know if this is possible at all... a friend of mine a while back said it was but we never got into it.

Tell them to just change ports, run the ssh daemon on 50 different ports.
that's not 2 much to ask

I know i can tell them to change ports, but its not what I want, it doesnt solve my problem, just creates more problems... go try telling endusers to use even port 8080 as the webserver port, they will go nuts.

The only solution i see to my problem is buying like a C block of IP addresses, but that would be way too expensive, which would defete what I am trying to do.

Dome:

Make the links to your web/ftp/etc sites yourself. Direct the users to an initial web page that is fixed then offer the list of services. The links would provide the :8080 etc. When they click on them ti does it automagically....

Otherwise, by using simple NAT it can't be done as far as i can tell....

it would raelly take a long time to try to explain what exactly i would be trying to do with all of this, but that wouldnt cut it.

But if anyone knows of a way that you can basically bind a registered domain name to an internal IP in some sort of way then let me know.

If you've got 50 servers you should be able to get a class C pretty cheap if you're in a datacenter, which with 50 servers, you should be

Would it work if you used different subnets? you may have to manually set Ips but then technically they should be different address' and allow connections to them without ports interfering. I guess to take this one step further, are you attemping to access this from the outside world or just playing internally in the network?

If you are wanting access from the outside world you could tell users on the outside they are different ports and then just route the port interally to the correct ip

edit: I just saw you were trying to bind multiple domains to internal Ips, not sure if this would work right but check it out http://www.4guysfromrolla.com/webtech/072700-1.shtml

You're looking for 'Split DNS' , look on google

to answer some questions no i dont have 50 physical servers, I am trying to build something to run a hell of a lot of Virtual Machines for learning and testing purposes, so lets say 10 machines all run SSH and FTP, i need it so that box1.domain.org goes to 1 of the machines and box2.domaind.org goes to another.

Bleh this is getting to complicated, i think half of you dont understand me, and this is probably not even possible.

Split or Double DNS won't work from a single external IP to a series of internal, (private IP's), because the DNS will have to resolve to private addresses the the remote clients won't be able to directly connect to across the public network...... Think again.... ;)

well im not really going to worry about it, someone has told me before that there might be some sort of firewall software out there that might be bale to do it.

thanks for the 'help'

There must be a solution... On my host, if you try to connect to a subdomain that doesn't exist, you end up at the subdomain that comes first alphabetically (in stead of getting a DNS or 404 error). How hard can it be to fetch that subdomain-request, and redirect it to the actual subdomain...

I think that the posibility is DEFINATELY there.... but the question is has it been done before? I definately dont have the programming skills to code a gateway that would do this, but i'm sure someone out there could.

I never really looked at a disected packet to see waht it looks like but i'm sure there is a tag somewhere for host address that is being requested.... and on that note they can easily do a if host address = box1.domain.org then forward to 192.168.20.4 .....

my theory, and it would definately save people tons of money and solve the problem of IP shortage until IPv6 is active

Well.... You can point multiple hosts to the same IP address but once you hit the machine it's controlled by the port the request is sent to. Same applies to a NAT firewall/router. No firewall is going to be able to sort that out because they really don't care about the domain name, they care about the IP address and port. Since you are NATting at the firewall you are restricted to forwarding ports.... Thus, a single port can only be forwarded to a single machine... If you want the same port number forwarded to two different machine you are SOL.... You'll confuse the router if it lets you try and nothing should go through.

If you want to provide the same service on multiple machines you need multiple public addresses..... Thus you will have to pay. Alter the port numbers and provide a way for your remote clients to select the resource without having to worry about the port numbers and you can make it work..... otherwise, it's not possible.

Amen Tigershark.

( I had to throw that in to reach 50 posts today, haha )

I still think it is somewhat possible, there is just nothing out there right now to support it.

Sure it would add alot of overhead, but it would basically be like the overhead store-and-forward causes.

I would add that in some cases you can have two or more "similar" services listening in different ports. For instance, you can have several smtp or ftp or web servers listening on different ports. The problem then becomes that the client or request maker need to know this ahead of time and specify which port to use to make the connection.

Since web browsers can make requests via names, you can have more than one "virtual" host using the same ip and the web server will use tools like "host header resolution" to determine which "virtual" to answer with.

Quote:

---

Originally posted here by Dome
I know i can tell them to change ports, but its not what I want, it doesnt solve my problem, just creates more problems... go try telling endusers to use even port 8080 as the webserver port, they will go nuts.

The only solution i see to my problem is buying like a C block of IP addresses, but that would be way too expensive, which would defete what I am trying to do.

---

What about using subdomains to tell the end users which are setup with a redirect
to the hosts using alternate ports?

Well... I'd disagree with whether it's possible unless someone alters the IP version 4 protocol.... It doesn't contain the destination domain.... That's why we have DNS, to resolve that prior to transmission. The packets contain only the destination IP address and port. The packet is handled by the receiving device based entirely upon that. If it tried to do a reverse DNS on an IP that contains multiple hosts its always going to resolve back to itself at a single IP..... Then port number is the only variable at the NAT device..... Forward the port to multiple internal IP's will confuse the router at best..... It probably won't be allowed by the router itself.

Quote:

---

Originally posted here by ss2chef
What about using subdomains to tell the end users which are setup with a redirect
to the hosts using alternate ports?

---

Hrm.... do you mean lets say external ip is 209.42.40.111

box1.domain.org:22 ---> 209.42.40.111:55051
box2.domain.org:22 ---> 209.42.40.111:55052

etc.

is that possible?

or still same problem?

Quote:

---

Originally posted here by Dome
Hrm.... do you mean lets say external ip is 209.42.40.111

box1.domain.org:22 ---> 209.42.40.111:55051
box2.domain.org:22 ---> 209.42.40.111:55052

etc.

is that possible?

or still same problem?

---

good problem...let me play with it...I thought you could set up sshd in a "gateway" configuration for problems like this.

ok one of my buddies on IRC said its def possible....

his answer is NAT to quote
<Anti-Hero> box2.doman.org resolves to pub IP which is then NAT to internal
addy., firewall rules port forward to 22. box2.domain.com
resolves to pub IP which is NAT to internal addy.

he will explain it more sometime tonight or tomorrow when we both have time

NM, missunderstood, thats not intirely possible, i will update if i find a solution

I still think if you use the code from this site and edit it then it should work fine.

for instance if you have everything come from the outside and hit a main server on the inside then use that server to distribute the information to your internal network I would assume it would work.... So you make the request to box2.domain.org the request goes to a server the server see it

Quote:

---

if Request.ServerVariables("SERVER_NAME") = "www.box2.domain.org" or _
Request.ServerVariables("SERVER_NAME") = "box2.domain.org" then
file = "192.XXX.XXX.XXX:PortNumber"
siteId = 2

---

Given if you go this route you may have to change the ports internally but maybe not, it may just make the request if you have a name server inside your network or if you make your main server a Name Server also.

Just some thoughts for you

Isn't this what isp's to every day???

Router/firewalls don't NAT the same port to different internal IP's....

Look at the protocol.... He's not just asking to host www, mail and ftp..... Which can be done at the server level, (note _server level_ the requests all go to the same box....), he want's multiple boxes hosting ssh.... well thats port 22..... Show me in the RFC where TCP/IP has the frigging domain name in the packet... please...... I'd love to learn.....

As it stands the router/firewall choses what to do with the packet on a port level, ('cos the address is always the same - it's own WAN address).... so, unless they are now programmed with telepathic powers how would they know which host the port 22 request is destined for????

Quote:

---

Originally posted here by Spyrus
I still think if you use the code from this site and edit it then it should work fine.

for instance if you have everything come from the outside and hit a main server on the inside then use that server to distribute the information to your internal network I would assume it would work.... So you make the request to box2.domain.org the request goes to a server the server see it


Given if you go this route you may have to change the ports internally but maybe not, it may just make the request if you have a name server inside your network or if you make your main server a Name Server also.

Just some thoughts for you

---

Hey Hey,

Good to see yer looking Spyrus, however this is ASP and will only work for a webserver. Since Dome wants to deal with SSH and other servies it won't work. I used to run a similar perl script on my server but it works because the HTTP protocol contains the SERVER_NAME variable, however when you recieve SSH there's no way to distinguish between the name, like Tiger Shark mentioned......

I suppose you could rewrite applications ;).. I know you aren't a programmer, but if you could find yourself one... you'll be set.. here's what you'd need to do.

2 apps are required:
The first is an SSH Client that will let you specify your source port, who knows this may already exist.
The second is a gateway running a, for lack of a better description, a modified version of PAT.

Basically what you do is have the gateway app look at the source port on the packets and forward them on to specific internal IPs based on the SRC port. Have it remember which source ports are associated with which Internal IPs.

You'd end up with something like this.

Gateway:
Forward SRC PORT 2222, DST PORT 22 to box1:22
Forward SRC PORT 2223, DST PORT 22 to box2:22
Forward SRC PORT 2224, DST PORT 22 to box3:22

SSH from X.X.X.X:2222 to ExternalIP:22, the gateway will forward you to box1.


Now that I've thought about it, ettercap does packet mangling, although I'm sure with some research you could find better software. Just configure a shitload of ettercap rules, and have it mangle the packets appropriately. Each Above forward rule would be a filter and it would mangle the packet to contain the internal IP address, rather than the External Address. This means you'll have to have 1 gateway PC that shares the net connection with the rest of the PCs (through switch, hub, whichever... 2 NICs in the PC).. however it should work, now all you have to do is find an SSH client that will let you specify the source port.

Peace,

HT

Damn, that took a while to write.

[Edit]
So... the more I look at that the more I realize it's a horrid idea, may as well just have them specify a different destination port... so how about this.

1 Gateway machine serving the rest of the machines, this is similar to the webpage of links idea. For HTTP use the script that was posted above, or grab a simple php/perl one (you could get one that'll function in less than 10 lines). Then use CNAME entries to reference them for website access. For SSH, have a script listening on port 22 of the primary machine, When they login, display a menu.. no shell available.. just a menu. Let them choose an internal Machine (i.e. 1: Box1 2: Box2 3: Box3). They can then just hit a number (1,2,3) and be forwarded to that machine.

[/Edit]