doctorzeromdApr 11, 2024

Port forward to different IP based on destination address in opnsense

https://lemmy.world/post/14180978

Port forward to different IP based on destination address in opnsense - Lemmy.World

cross-posted from: https://lemmy.world/post/14180956 [https://lemmy.world/post/14180956] > Hello all you lovely people! > > I’m trying to figure out if I can port forward to different servers based on the destination domain. > > I have a domain with a wildcard cert and I’d like to be able to route all traffic headed towards “1.domain.com [http://1.domain.com]” to a server I’m calling “1”. I’d still like traffic headed to domain.com [http://domain.com] to go to where it’s currently going, we can call this server “0”, and to be able to have a 2.domain.com [http://2.domain.com] or 3 or 4 in the future. > > I thought that having a port forward rule with: > interface: WAN > Protocol: any > source: any destination: a url alias including 1.domain.com [http://1.domain.com] > redirect target ip: local ip > > Would work, but it doesn’t seem to. Any tips?

Show threadjevans ⁂Apr 11, 2024
you need a reverse proxy.
Show threaddoctorzeromd
I have a reverse proxy, but that won’t do ALL traffic, right? Just http or https?
Apr 11, 2024 at 9:57pmWeb
Show threadadONisApr 11, 2024

you only have one IP. As you rightfully said, reverse proxy does only http(s), port 80/443. this works because of the nature how http requests work. They carry the hostname as part of the protocol (request headers). SSH is a whole other story, since the client does not send the hostname as part of the protocol, only the IP and the port.

What you can do is forward different ports to different machines… 2021 -> server1, 2022 -> server2, etc.

Show threadBjörnApr 12, 2024
For SSH the ’ProxyJump’ directive is awesome. Have one server reachable from outside and then use it to jump to all the others.
Show threadjevans ⁂Apr 11, 2024
Like the other commenter said, that is correct. For SSH, I set up a VM as my SSH bastion or jump host. I connect to that, and the SSH from that to any other machine on the network.
Show threadlemmyvoreApr 12, 2024

If you control the software stack at both ends you may want to consider Chisel which is a HTTP tunnel for TCP and UDP.

The connections would go SSH client > Chisel client > HTTP reverse proxy > Chisel server > SSH server. The Chisel parts speak HTTP to each other so that part can be routed by domain.

Chisel can also do its own encryption so you can use HTTP and avoid the HTTPS-specific issues about extracting the domain name from the HTTPS connection.