Solved Trying to redirect traffic to jail with public IP

pentago

pentago

Hi, iI'm trying to serve a website for a friend on my VPS which uses jails for each service iI need.

I configured this new jail for friends website but seems iI fail to properly configure PF to redirect traffic on second public IP iI have to new jail.

This is my pf.conf:

Code: 
# Macros
nic = "vtnet0"
ip1 = "111.111.111.111"
ip2 = "222.222.222.222"
lan = "192.168.1.1/24"
www1 = "192.168.1.2"
www2 = "192.168.1.5"

# Options
set skip on lo
set block-policy drop
set loginterface $nic

# Normalization
scrub in no-df random-id

# NAT
nat pass on $nic from $lan -> $ip1
rdr on $nic inet proto tcp to port {80,443,30000,44000} -> $www1
nat pass on $nic from $www2 -> $ip2
rdr on $nic inet proto tcp to $ip2 port {80,443} -> $www2

# Filtering
block in log
antispoof quick for $nic inet
pass in proto tcp to port {25,80,443}
pass out

Traffic to www1 works properly but www2 isn't for some reason.
Can anyone push me in right direction or offer potential solution?

Thanks in advance!
 
Try this...
Code: 
int_net = "192.168.1.0/24"
nat on $nic from $int_net to any -> $nic
rdr on $nic proto tcp from any to $ip1 port {80,443,30000,44000} -> $www1
rdr on $nic proto tcp from any to $ip2 port {80,443} -> $www2
 
Hey mate, just tried it, doesn't work as intended.

Should I first create interface alias perhaps for this setup to work?

I assigned that jail a lo1 interface (same as with other jails), maybe that info helps perhaps?
 
Remington said:
You need interface alias for both public and private ip addresses.
Click to expand...
Not really needed if you set the correct redirection rules on PF.

A better solution might be to install net/haproxy on the host and have it direct traffic to the correct jail backend. That way you can have multiple web sites on the same IP address, which is normally not possible because you can only forward port 80 once per IP.
 
SirDice said:
Not really needed if you set the correct redirection rules on PF.

A better solution might be to install net/haproxy on the host and have it direct traffic to the correct jail backend. That way you can have multiple web sites on the same IP address, which is normally not possible because you can only forward port 80 once per IP.
Click to expand...

Hmm, could you help with those PF rules perhaps?

I prefer not to install unnecessary software if something built-in can handle the job.
 
I think this should do the trick:
Code: 
nat on $nic from $www1 -> $ip1
nat on $nic from $www2 -> $ip2
nat on $nic from {$lan,!$www1,!$www2} -> ($nic)

rdr from any to $ip1 port {80,443,30000,44000} -> $www1
rdr from any to $ip2 port {80,443} -> $www2

Not tested though, the third NAT may need adjustment so it doesn't include the addresses of $www1 and $www2. Both need to be translated to their "own" address.
 
SirDice said:
I think this should do the trick:
Code: 
nat on $nic from $www1 -> $ip1
nat on $nic from $www2 -> $ip2
nat on $nic from {$lan,!$www1,!$www2} -> ($nic)

rdr from any to $ip1 port {80,443,30000,44000} -> $www1
rdr from any to $ip2 port {80,443} -> $www2

Not tested though, the third NAT may need adjustment so it doesn't include the addresses of $www1 and $www2. Both need to be translated to their "own" address.
Click to expand...

This may work, I haven't tested it yet, with few ip addresses but if handling 30 to 60 ip addresses then aliases is better as your third nat line will be very long. If using multiple ip addresses then the below example is better.

Code: 
ifconfig_em0_aliases="inet 192.168.0.1-60 netmask 255.255.255.0"
 
SirDice said:
I think this should do the trick:
Code: 
nat on $nic from $www1 -> $ip1
nat on $nic from $www2 -> $ip2
nat on $nic from {$lan,!$www1,!$www2} -> ($nic)

rdr from any to $ip1 port {80,443,30000,44000} -> $www1
rdr from any to $ip2 port {80,443} -> $www2

Not tested though, the third NAT may need adjustment so it doesn't include the addresses of $www1 and $www2. Both need to be translated to their "own" address.
Click to expand...

Just tried SirDice's suggestion and it didn't work as we thought. I kinda wanted it to work to avoid creating interface alias but ok, Remington's suggestion worked so I won't bother you guys any more with this.
If something pop on your mind I'll try it, if not, its not a biggie, main goal is achieved. :)
Thank you all people!
 
You must log in or register to reply here.
Back
Top