Monday, February 12, 2018

Is there a way to forward a port based on subdomain?











Basically I want to have something like this:



name1.mydomain.com:1234 -> my.internal.ip.address:10001
name2.mydomain.com:1234 -> my.internal.ip.address:10002
name3.mydomain.com:1234 -> my.internal.ip.address:10003
name4.mydomain.com:1234 -> my.internal.ip.address:10004
name5.mydomain.com:1234 -> another.internal.ip.address:10001
name6.mydomain.com:1234 -> another.internal.ip.address:10002



Can be at the router level, internal dns server level or even some other machine on the local network running some app that just passes traffic on to the proper machine on the proper port.



More clarification: it is not HTTP traffic, but our own custom protocol (our own client/server application using Remoting in .NET)



Answer



OK, let's clear up some confusion here...



First up, there's no explicit requirement in your question that all of those names resolve to the same IP address -- so, you can assign a block of addresses to your router device, have the DNS records setup to provide a one-to-one mapping of name to IP address, and then use DNAT (Destination Network Address Translation) to forward the traffic on to internal devices.



I will continue on the assumption that you don't have the ability to throw a pile of IP addresses at the problem.



In general, for an arbitrary protocol running inside of TCP or UDP (because other protocols that run on top of IP don't necessarily have any concept of ports), you cannot do what you want to do, because there is no guarantee that there is any information inside the traffic "stream" to allow such routing to take place. Certain protocols, in an attempt to get around this very problem, do embed name information in their protocol (such as HTTP, with the Host header), and for those protocols there are typically proxies that will receive a request, determine the name that was presented, and then route the request to an appropriate location. Some of those proxies have been mentioned in other answers, and if those do not suffice you will no doubt receive appropriate answers if you tell us what layer 7 protocol you are attempting to proxy.



However, the vast majority of protocols do no name-based identification of their intended destination, and for those you have no option but to use IP addresses to control the flow of traffic to different internal endpoints.




EDIT: If you're defining your own protocol, it should be possible to embed the name of the host you're connecting to inside it somewhere, and then you'll just have to write your own proxy (possibly as a plugin to some existing piece of software) to take those requests, map them to the correct backend, and pass them through.


No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...