Route to multiple VMs from web using one public IP

[scottybeam]

Can anyone point me in the general direction to learn how I would go about hosting multiple linux VMs serving websites using a single public IP ?

If I port forward on the router to one VM, I can't use port 80/443 to route to another... My prelim findings have turned up haproxy, but I'm stuck since I admittedly don't have experience with it (results seem to focus on load balancing mainly).

Or if there's an even better solution, I'm all ears.

 

[bobmc]

nginx is probably the best known solution

this should get you started
https://webdock.io/en/docs/how-guid...e-nginx-to-serve-multiple-websites-single-vps

there's a nice GUI version of nginx but it's only available as a docker container.
https://nginxproxymanager.com/

Proxmox doesn't support docker by default but it can be installed
https://www.servethehome.com/creati...ion-and-container-setup-with-management-guis/

 

[scottybeam]

I appreciate the feedback -- I think I probably should have emphasized that I am redirecting to *different* internal IPs attached to different VMs which are hosting their own apache servers. Not multiple sites on one machine.

One public IP --> router --> Port fwd 80/443 --> [proxmox] --> internal IP #1 on VM listening on 80/443
                                                           --> internal IP #2 on VM listening on 80/443
                                                           --> internal IP #3 on VM listening on 80/443

Obviously the above scheme doesn't work, so I'm open to any solutions to achieve that effect. Many thanks

 

[2707974]

I appreciate the feedback -- I think I probably should have emphasized that I am redirecting to *different* internal IPs attached to different VMs which are hosting their own apache servers. Not multiple sites on one machine.

Public IP --> router --> Port fwd 80/443 --> [proxmox] --> internal IP #1 on VM listening on 80/443
                                                       --> internal IP #2 on VM listening on 80/443
                                                       --> internal IP #3 on VM listening on 80/443

Many thanks

You can do that with haproxy or nginx

 

[2707974]

You can do that with haproxy or nginx

I will present very simple solution that you can use like start point in your lab environment.

   | internet
   |
   | public ip
----------                             |-------|
| router |                      /------| web01 |
----------       |---------|  /        |-------|
     |-----------| haproxy |==
                 |---------|  \        |-------|
                                \------| web02 |
                                       \-------|
----------------------------------------------------------------
|                                proxmox                       |
----------------------------------------------------------------

traffic flow:

internet -> public_ip -> port forwarding 80 and 443 to haproxy private ip
haproxy will get traffic and based on http requested domain will make routing decision to send trafic
to web01 or web02

Example ip addressing

haproxy: 10.10.10.10/24 gw: 10.10.10.1
web01:   10.10.10.11/24 gw: 10.10.10.1
web02:   10.10.10.12/24 gw: 10.10.10.1

router lan interface: 10.10.10.1

You must have SSL cert for both sites. Let's Encrypt is free and fine solution

Very basic haproxy config for this topology

global
    log 127.0.0.1 local2 debug
    maxconn 2000
    tune.ssl.default-dh-param 2048
    user haproxy
    group haproxy

defaults
    mode http
    log global
    option http-server-close
    option httplog

frontend https
    bind 10.10.10.10:80
    bind 10.10.10.10:443 ssl crt /etc/ssl/certs/domain01.pem crt /etc/ssl/certs/domain02.pem
    http-request redirect scheme https code 301 if !{ ssl_fc }
    mode http
    option http-keep-alive
    acl domain01 ssl_fc_sni domain01.com
    acl domain01 ssl_fc_sni domain02.com
    use_backend domain01-back if domain01
    use_backend domain02-back if domain02

backend domain01-back
    mode http
    balance roundrobin
    server web01 10.10.10.11:80 check
backend domain02-back
    mode http
    balance roundrobin
    server web02 10.10.10.12:80 check

Like I say, this is very basic conf and is not for production use.
Now you have starting point for your research

 

[scottybeam]

I will present very simple solution that you can use like start point in your lab environment.



Like I say, this is very basic conf and is not for production use.
Now you have starting point for your research

This is awesome -- thank you very much, great jumping off point that looks like it's going to give a great head start.

 

[aaronouthier]

The general term for what the OP is trying to get going is called a Reverse Proxy, if I understand the question correctly. Yes, NGINX is the best known. I had a something similar setup on my pfsense router, using squid. The reverse proxy interface was clunky at best. Took me over a week to get it figured out and working. When I finished, requests for office.<mydomain>.net went to my onlyoffice box, while requests for cloud.<mydomain>.net went to my nextcloud install. Likewise, cameras. went to bluecherry, etc. It didn't matter what port the destination service was running on either.

 

[Chris Thompson]

Check out "NGINX Proxy Manager" (NPM). It's a GUI to Manage your NGINX Reverse Proxy. Runs as a Docker Container (so you'll need to spin-up a VM or Container to run Docker). Really a great web front end to manage reverse proxies and includes SSL Cert Management via Letsencrypt.

 

[scottybeam]

Awesome thank you all ! Really appreciate the guidance