OPNsense

508 readers

3 users here now

All discussions about the open source, FreeBSD-based firewall called OPNsense.

founded 2 years ago

MODERATORS

IceBearCushion

Port forward to different IP based on destination address (self.opnsense)

submitted 8 months ago by doctorzeromd to c/opnsense

9 comments fedilink hide all child comments

Hello all you lovely people!

I'm trying to figure out if I can port forward to different servers based on the destination domain.

I have a domain with a wildcard cert and I'd like to be able to route all traffic headed towards "1.domain.com" to a server I'm calling "1". I'd still like traffic headed to domain.com to go to where it's currently going, we can call this server "0", and to be able to have a 2.domain.com or 3 or 4 in the future.

I thought that having a port forward rule with: interface: WAN Protocol: any source: any destination: a url alias including 1.domain.com redirect target ip: local ip

Would work, but it doesn't seem to. Any tips?

you are viewing a single comment's thread
view the rest of the comments

[–] doctorzeromd 2 points 8 months ago (3 children)

I'm familiar with reverse proxies, but that won't do ALL traffic, right? Just http or https?

Like if I want to ssh into the different servers, it won't handle that, will it? (Not saying ssh is my goal, I recognize how risky that would be)

[–] greco 2 points 8 months ago (2 children)

It will accept all traffic sent to it via the ports it is listening on, just like any other service. It doesn't have to forward everything though, and what it does with that is up to it's configuration options and what you do with those.

Since you mentioned the wildcard cert, I assumed you were talking about services that speak http/s, and that they'd probably be on port 443. Those were a lot of assumptions by me.

If it's not an http/s type service, what kind of services are we talking about?

[–] doctorzeromd 1 points 8 months ago (1 children)

I'd like to self host matrix, and it seems like there are a bunch of not HTTP/s ports that need to be accessible

[–] greco 2 points 8 months ago

Can you maybe share some more information? Do you have a list of services, how you want them mapped, etc.?