I have a host with one IP address which is using port 443 (HTTPS) with one certificate. I want to run a second app on this IP address using a different certificate on a different port. To prevent people from seeing or having to type that other port number, I would like to use a second host to proxy connections on port 443 to the custom port on the first host.

I am wondering if this is possible using only Linux IPtables rules, so that there doesn't need to be an application performing the proxy. The second host is not on the same network, so I am asking if it is possible to NAT from external IPs to another external IP. I've seen lots of guides for NATing from external to internal and vice versa, but never external to external.

The usual approach of adding a second IP addr to the first host is not an option here.

I am aware that "bouncing" through the second host will be a slight performance hit, but I'm OK with that.

  • As long as the computer you want to have be the proxy, can communicate with the web server, then this should work. I can't provide help to get that setup as I'm unfamiliar with Linux IPtables so hopefully someone else can chime in. Personally I'd try to solve the problem by placing shortcuts with the port defined already inside the shortcut but I know this solution doesn't always work for all environments. – Geruta Aug 4 '15 at 2:13
  • If your using apache or web server you could probably just make a subdomain and have it redirect to whatever port you want. Instead www.app.com you could also have something.app.com Forward internally should be the same as externally. iptables -A PREROUTING -p tcp -m tcp -m multiport -i eth0 -j DNAT --to-destination <ip addr> --dports 1234 – cybernard Aug 4 '15 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.