0

A few other questions on here cover how to do this on a single server but I'm having trouble figuring out how to build this with multiple Web servers behind a single external IP.

I have a simple network of:

{Interwebs} <--> PfSense (router/firewall) <--> multiple Web servers on the same LAN

I have a single external IP address on the PfSense box and a single domain I own, example.com. I can create DNS A records for app1.example.com, app2.example.com and so on that point to that one IP. In the internal network I have several Web apps all running on their own server.

What would I need to do to have external clients able to reach each of those internal Web servers over a unique subdomain? A "reverse proxy" or something else? What Linux-compatible software is commonly used for this?

All of the Web apps would be available only via HTTPS (HTTP would be available but always redirect to HTTPS) and each Web app would have its own SSL certificate. I can likely ignore/not support older clients (such as those that don't support SNI) if it helps.

closed as too broad by dan Jun 8 '16 at 23:52

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is unfortunately a bit too broad a question, but you're on the right track in regards to using a reverse proxy such as Nginx or Apache's mod_proxy module. – dan Jun 8 '16 at 23:58
  • This can also easily be done using deep packet inspection in a firewall and possibly protocol filter rules [HTTP(S) in this case]. – closetnoc Jun 9 '16 at 2:27
1

off topic but you can use nginx as a reverse proxy. Create your domain.conf in /etc/nginx/conf.d/

Below pulled from working config nginx version: nginx/1.9.15, you can repeat stanzas for each app but i would break them up into app.domain.conf, app1.domain.conf, etc

server  {
    listen  80;
    server_name  *.domain.com; #redirect http to https
    return 301 https://$host$request_uri;
}
server  {
    listen  443 ssl http2;  #use http2 if you install from nginx.org repo
    https://app1.domain.com
    server_name  app1.domain.com;
    ssl  on;
    ssl_certificate  ssl/app.domain.crt; #to your cert
    ssl_certificate_key  ssl/app.domain.key; #to your key
    ssl_stapling_verify on;
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header x-xss-protection "1; mode=block" always;
    ssl_session_timeout  5m;
    ssl_prefer_server_ciphers  on;
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
      location  / {
         proxy_pass  http://interal_ip_to_app1:8080/;
      }
}

Not the answer you're looking for? Browse other questions tagged or ask your own question.