Redirecting http traffic based on host header request

Forums › LAN (ethernet/Wi-Fi/routers/switches/Bluetooth) › Redirecting http traffic based on host header request

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#18772 23-Jan-2008 12:02

This is not that important, because I access my WHS via Hamachi, which means I am always connected to it regardless of location or network my laptop is using at the moment, but...

In my LAN I have a Windows Server 2003 running Exchange. This is where my router forwards all port 80 and 443 requests to.

Another machine runs WHS and of couse there are the sites using port 80 and 44 - WHS, Whiist photo pages, WebGuide.

Is there any software you would recommend I could run on a server around here that would receive the port 80 and 443 requests, check the header request and forward to the appropriate IP based on the domain name present in the request?

For example freitasm.homeserver.com would go to my WHS machine while freitasm.com would go to my Windows Server/Exchange machine?

Any ideas appreciated...

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

1 | 2

5053 posts

Uber Geek
+1 received by user: 1280

Trusted

#106255 23-Jan-2008 12:28

Perhaps you could have one or the other sites on non-standard ports (Ie. Move homeserver to :81) and then have IIS on server 2003 box redirect to that based on host header?

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#106256 23-Jan-2008 12:30

If the home server had the sites on non-standard ports then I wouldn't need to check headers, the router would do a good job redirecting based on port number only...

That should work, but I wanted to keep changes on the machines themselves to a minimum - even if this involves including a new box (or virtual machine) just to switch between applications.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

chiefie

I iz your trusted friend
5877 posts

Uber Geek
+1 received by user: 151

Retired Mod

Trusted

Lifetime subscriber

#106259 23-Jan-2008 12:48

Well this is the very question I asked when I was beta testing it, posted in the Connect forum, and later was told there's no plan on making this co-exist with SBS2003 for those users who have another HTTP/HTTPS server on the same IP.

I did came across a theory that uses a reverse-proxy to translate the request, as this is needed for each SSL. Since you have one IP address, and access to HTTPS (443) need a certificate and it is tied to an IP address, with reverse-proxy, you can have two domain names, and access the default ports (80 or 443) and the reverse proxy will determine which internal IP address should the traffice/request be routed to, and uses its internal SSL certs to communicate between outside world and internal servers.

But I have yet been able to find a way to make this reverse-proxy working. ISA 2004/2006 said to be able to support it, but my last attempt in installing ISA on SBS had created a frankenstein Mohican (SBS2003 @home)...

I too would like to get SBS2003 and WHS to co-exist, if this puzzle is solved, then I would be happy to migrate all web and email services back to home.

I supposed another way is, only allow Exchange 2003's OWA on 443, and WHS only operate HTTP (80). And to admin WHS, just get Hamachii VPN and access WHS that way? Simplest?

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

chiefie

I iz your trusted friend
5877 posts

Uber Geek
+1 received by user: 151

Retired Mod

Trusted

Lifetime subscriber

#106260 23-Jan-2008 12:50

Oh also... if only allowing OWA (Exchange 2003) to acknowledge incoming connection on HTTPS (443). I wonder how will this affect Exchange-ActiveSync, OMA etc? If I isolate all Exchange traffics to 443, and all mobile devices can get to it without difficulty, then I might just route all Exchange traffics to 443 (on the router) and all other HTTP (80) goes to WHS.

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

chiefie

I iz your trusted friend
5877 posts

Uber Geek
+1 received by user: 151

Retired Mod

Trusted

Lifetime subscriber

#106261 23-Jan-2008 12:52

freitasm: If the home server had the sites on non-standard ports then I wouldn't need to check headers, the router would do a good job redirecting based on port numbr only...

I have tried that.. port forwarding doesn't work for incoming 443 (at least on my router, it didn't work at all).

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#106263 23-Jan-2008 12:56

Apparently this can be done by using Reverse Proxy on Squid.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

New World

Shop on-line at New World now for your groceries (affiliate link).

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#106264 23-Jan-2008 12:59

Later tonight I am going to try Squid on a virtual machine and if it works ok forward all port 80 and 443 traffic to that virtual machine to handle this...

I will post results later.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

chiefie

I iz your trusted friend
5877 posts

Uber Geek
+1 received by user: 151

Retired Mod

Trusted

Lifetime subscriber

#106266 23-Jan-2008 13:05

Awesome.. please do investigate and document a step by step (or tutorial) and I'll be please to follow your guide, as I have been wanting to get both WHS and SBS2003 co-existing. (Wish Nathan or Daryl have some solution though!)

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

lyonrouge

1993 posts

Uber Geek
+1 received by user: 20

Trusted

Lifetime subscriber

#527612 30-Sep-2011 11:31

I've got this working with a wildcard certificate generated from my internal (MS) CA (not covered here). Note: Squid is routing traffic to TMG reverse proxies, but I've had this solution working directly to the backend servers in the past.

I have used CentOS 5.5 with Squid 2.6STABLE21. If you're a windows user like me, the included CentOS software updater is the easiest way to install the Squid server.

In this example xxx.xxx.xxx.001 is the web listener address for RCP/HTTPS and xxx.xxx.xxx.002 is for HTML (SSO) traffic, you will need to enter you addresses as applicable. The following squid.conf :

# Allow ActiveSync & Outlook Anywhere
extension_methods RPC_IN_DATA RPC_OUT_DATA

# This configuration MUST appear at the top of squid.conf above any other forward-proxy configuration (http_access etc),
# otherwise the standard proxy access rules block some people viewing the accelerated site.
https_port 443 cert=/etc/pki/import/public.cer key=/etc/pki/import/private.pem defaultsite=yourdomain.co.nz vhost
#https_port 443 cert=/etc/pki/public.crt key=/etc/pki/private.key defaultsite=yourdomain.co.nz vhost

# First HTTPS peer, SharePoint Enterprise
cache_peer xxx.xxx.xxx.002 parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER name=spEnt

acl sites_server_1 dstdomain sp2.yourdomain.co.nz
cache_peer_access spEnt allow sites_server_1
http_access allow sites_server_1
miss_access allow sites_server_1

# Second HTTPS peer, Exchange
cache_peer xxx.xxx.xxx.001 parent 443 0 no-query originserver login=PASS ssl sslflags=DONT_VERIFY_PEER name=ex

acl sites_server_2 dstdomain ex1.yourdomain.co.nz
cache_peer_access ex allow sites_server_2
never_direct allow sites_server_2
http_access allow sites_server_2
miss_access allow sites_server_2

# Forth HTTPS peer, Webmail
cache_peer xxx.xxx.xxx.002 parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER name=owa

acl sites_server_4 dstdomain webmail.yourdomain.co.nz
cache_peer_access owa allow sites_server_4
http_access allow sites_server_4
miss_access allow sites_server_4

# Sixth HTTPS peer, File Server HTTP and WebDAV access
cache_peer xxx.xxx.xxx.002 parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER name=webdav

acl sites_server_6 dstdomain fs1.yourdomain.co.nz
cache_peer_access webdav allow sites_server_6
http_access allow sites_server_6
miss_access allow sites_server_6

# Seventh HTTPS peer, SharePoint Standard
cache_peer xxx.xxx.xxx.002 parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER name=spStd

acl sites_server_7 dstdomain sp1.yourdomain.co.nz
cache_peer_access spStd allow sites_server_7
http_access allow sites_server_7
miss_access allow sites_server_7

Note: it is rumoured that RD Gateway is supported through Squid 2.7, but I could not get it to work.

magu

Professional yak shaver
1599 posts

Uber Geek
+1 received by user: 7

Trusted

BitSignal

Lifetime subscriber

#527617 30-Sep-2011 11:43

You could also do this with Nginx in load-balancer mode. Access each upstream (internal IP) based on rules. Works even for SSL.

"Roads? Where we're going, we don't need roads." - Doc Emmet Brown

lyonrouge

1993 posts

Uber Geek
+1 received by user: 20

Trusted

Lifetime subscriber

#527673 30-Sep-2011 13:25

Vyatta too ibelieve, do you have the key instructions/config for Nginx?

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

magu

Professional yak shaver
1599 posts

Uber Geek
+1 received by user: 7

Trusted

BitSignal

Lifetime subscriber

#527679 30-Sep-2011 13:30

Google has plenty of examples, but it's basically this, doubled (a different name for each upstream plus a different server definition for each Host you want to redirect):

http://wiki.nginx.org/LoadBalanceExample

"Roads? Where we're going, we don't need roads." - Doc Emmet Brown

lyonrouge

1993 posts

Uber Geek
+1 received by user: 20

Trusted

Lifetime subscriber

#527964 1-Oct-2011 09:44

Have you used this for RCP over HTTPS, namely RD Gateway?

lyonrouge

1993 posts

Uber Geek
+1 received by user: 20

Trusted

Lifetime subscriber

#532273 12-Oct-2011 11:17

Has anyone been able to get Remote Desktop Gateway traffic through a squid or squid3? I've tried PASS and PASSTHRU options but keep getting TCP_DENIED/403 RPC_IN_DATA.

chiefie

I iz your trusted friend
5877 posts

Uber Geek
+1 received by user: 151

Retired Mod

Trusted

Lifetime subscriber

#532276 12-Oct-2011 11:25

Wow... this topic is still alive! interestingly how I have moved on from OWA @ home to cloud now. *lol*

Internet is my backyard...

«Geekzone blog: Tech 'n Chips Takeaway» «Personal blog: And then...»

Please read the Geekzone's FUG

1 | 2