A few other questions on here cover how to do this on a single server but I'm having trouble figuring out how to build this with multiple Web servers behind a single external IP.

I have a simple network of:

{Interwebs} <--> PfSense (router/firewall) <--> multiple Web servers on the same LAN

I have a single external IP address on the PfSense box and a single domain I own, example.com. I can create DNS A records for app1.example.com, app2.example.com and so on that point to that one IP. In the internal network I have several Web apps all running on their own server.

What would I need to do to have external clients able to reach each of those internal Web servers over a unique subdomain? A "reverse proxy" or something else? What Linux-compatible software is commonly used for this?

All of the Web apps would be available only via HTTPS (HTTP would be available but always redirect to HTTPS) and each Web app would have its own SSL certificate. I can likely ignore/not support older clients (such as those that don't support SNI) if it helps.

  • This is unfortunately a bit too broad a question, but you're on the right track in regards to using a reverse proxy such as Nginx or Apache's mod_proxy module.
    – dan
    Commented Jun 8, 2016 at 23:58
  • This can also easily be done using deep packet inspection in a firewall and possibly protocol filter rules [HTTP(S) in this case].
    – closetnoc
    Commented Jun 9, 2016 at 2:27

1 Answer 1


off topic but you can use nginx as a reverse proxy. Create your domain.conf in /etc/nginx/conf.d/

Below pulled from working config nginx version: nginx/1.9.15, you can repeat stanzas for each app but i would break them up into app.domain.conf, app1.domain.conf, etc

server  {
    listen  80;
    server_name  *.domain.com; #redirect http to https
    return 301 https://$host$request_uri;
server  {
    listen  443 ssl http2;  #use http2 if you install from nginx.org repo
    server_name  app1.domain.com;
    ssl  on;
    ssl_certificate  ssl/app.domain.crt; #to your cert
    ssl_certificate_key  ssl/app.domain.key; #to your key
    ssl_stapling_verify on;
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header x-xss-protection "1; mode=block" always;
    ssl_session_timeout  5m;
    ssl_prefer_server_ciphers  on;
    ssl_protocols TLSv1.1 TLSv1.2;
      location  / {
         proxy_pass  http://interal_ip_to_app1:8080/;

Not the answer you're looking for? Browse other questions tagged or ask your own question.