networking - Thoughts on propsed network plan: port forwarding to servers, static IP addresses and DNS -


i'm setting 4 servers each have restful apis go on https. because we're in stages of startup, i'm going host these in closet.

i have business-class comcast service, can static ip address or series of them. ip addresses $10/ea per month, can save $30 if one. realize sounds i'm being super cheap, we're pinching pennies until customers.

we use 1 server "tools" server allow reach other servers via ssh; other 3 servers need have https open internet on lan.

i'm considering getting 1 static ip address, , using router forward https traffic various servers. port forwarding like:

wan port    lan port    server   22         22         tools 1443        443         server 1 (api via ssl)    2443        443         server 2 (api via ssl)    3443        443         server 3 (api via ssl)         

i set name records in dns be:

tools.mydomain.com   -> <static ip address>:22 server1.mydomain.com -> <static ip address>:1443 server2.mydomain.com -> <static ip address>:2443 server3.mydomain.com -> <static ip address>:3443 

is reasonable approach? work?

you cannot direct traffic specific tcp port dns records. can point @ ip-address. client default uses tcp port 80 http , port 443 https (unless explicitly name port use in url).

furthermore cannot have multiple https-based hosts using same ip address unless use same ssl certificate. because ssl handshake takes place before client reveals server hostname trying reach, server can give out ssl certificate based on ip address (and port) connected to.

in particular instance, if have 4 servers have same domain, can wildcard ssl certificate (i.e. covers *.mydomain.com) , can away 1 single public ip address 4 servers. point dns records same ip address , have server give out wildcard certificate valid regardless of hostname client using. after ssl handshake completed, server can @ host: -header in client request determine server request intended for, i.e. have 1 server acting https-endpoint https-requests received , internally forwarding unencrypted request correct server (or handle servernames virtually 1 physical server).

if using apache http server suggest read name-based virtual hosts , proxy forwarding:


Comments

Popular posts from this blog

javascript - Jquery show_hide, what to add in order to make the page scroll to the bottom of the hidden field once button is clicked -

javascript - Highcharts multi-color line -

javascript - Enter key does not work in search box -