On Tue, Nov 19, 2002 at 08:16:14PM -0800, Ed Herkel wrote:
> I have an OpenBSD box as a firewall/router between the
> outside and a single PC on the inside hosting two web
> sites on different addresses and ports. The way it was
> working with ipf (and the way I would like it to
> continue working, so I don't have to change my
> httpd.conf file -- not wanting to break more than one
> thing at a time) is that incoming requests to
> foo.com:80 were redirected to 192.168.0.1:8080 and
> those to bar.com:80 were redirected to
> 192.168.0.2:8090. This has worked fine for me with
> ipf.
> And all outgoing connections from inside were given
> the same IP address, that of the external interface on
> the gateway.
First, pf (as ipf) can redirect based on addresses, not domain names.
Neither of them looks inside HTTP requests and uses packet payload to
redirect to different servers. So, do you mean two specific IP addresses
when you say "foo.com:80" and "bar.com:80"?
If "foo.com" is a dedicated routable address assigned to the external
interface of the gateway, you either use an rdr rule to redirect port 80
to the internal web server:
rdr on $ext_if inet proto tcp from any to 1.2.3.4 port 80 \
-> 192.168.0.1 port 8080
and similarly for the second server. These then cover all incoming
connections to 1.2.3.4 port 80.
If it's ok to map all outgoing connections to the primary address of the
external interface (which can be either a third routable address or one
of the two used by the web servers), a single nat rule will do:
nat on $ext_if from 192.168.0.0/16 to any -> $ext_if
If you have three dedicated routable addresses on the external interface
(one for each web server, one for the gateway itself), you could use
binat to forward all connections to and from the web servers to their
own external addresses:
binat on $ext_if from 192.168.0.1 to any -> 1.2.3.4
binat on $ext_if from 192.168.0.2 to any -> 5.6.7.8
nat on $ext_if from 192.168.0.0/16 to any -> $ext_if
But if the only connections from and to the web servers are incoming TCP
connections to port 80, the two rdr rules are sufficient, and you don't
need the binat rules. The advantage of the binat rules would be that
they cover all ports, as well as map outgoing connections to the
respective external address of each web server, instead of just the
single external address of the gateway.
Daniel
