I have a host with one IP address which is using port 443 (HTTPS) with one certificate. I want to run a second app on this IP address using a different certificate on a different port. To prevent people from seeing or having to type that other port number, I would like to use a second host to proxy connections on port 443 to the custom port on the first host.
I am wondering if this is possible using only Linux IPtables rules, so that there doesn't need to be an application performing the proxy. The second host is not on the same network, so I am asking if it is possible to NAT from external IPs to another external IP. I've seen lots of guides for NATing from external to internal and vice versa, but never external to external.
The usual approach of adding a second IP addr to the first host is not an option here.
I am aware that "bouncing" through the second host will be a slight performance hit, but I'm OK with that.