I "believe" i have a valid solution in mind for my problem, however i wanted to see if I could get any additional input before moving forward.
THE ISSUE
I have a streaming media server (media-01) from which I generate a number of different media streams on unique ports and mountpoints.
I.E.
Windows Media (MMS, HTTP, RTSP) - multiple mountpoints
Shoutcast Streams (port 8000, 8002, 8004, etc.)
etc.
While this works correctly from the server side of things I want to be able to send ALL streams out to clients over Port 80 to avoid firewall issues.
In the past the way that I would have accomplished this with Astaro would be to take a unique IP address for each stream and write a DNAT rule to listen on WAN port 80, forward to LAN media-01 local LAN port for that specific stream.
I would now like to take advantage of Astaro's v8 Web Application Firewall to solve this issue with the use of only a single IP address.
The following post had provided some of the initial thought on this;
https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/44631
THE SOLUTION?
** example of streaming multiple shoutcast streams over Port 80 using a single public IP address
WAN IP x.x.x.100 (public IP)
LAN IP 10.0.0.20 (media-01)
FQDN DNS
Stream 1 stream1.domain.com
Stream 2 stream2.domain.com
Web Application Security --> Web Application Firewall
Setup "real web servers"
* name: realWebServer01
* host: media-01
* type: Plain (HTTP)
* Port: 8000
* name: realWebServer02
* host: media-01
* type: Plain (HTTP)
* Port: 8002
Setup 'virtual web servers"
* name: virtualWebServer01
* Type: Plain (HTTP)
* Domains: stream1.domain.com
* Interface: WAN IP x.x.x.100
* Port: 80
* Pass Port Header: checked
* Real Web Servers: realWebServer01
* name: virtualWebServer02
* Type: Plain (HTTP)
* Domains: stream2.domain.com
* Interface: WAN IP x.x.x.100
* Port: 80
* Pass Port Header: checked
* Real Web Servers: realWebServer02
What I believe would happen with this configuration is that the WAN IP address would be listening on Port 80 and based on the virtualWebServer which was invoked (based on the domain), it would the communicate with the real web server (the same server in both cases in this example) on the specific Port indicated.
Does this seem correct, or is there a problem that I'm missing here?
Thanks
Ryan
This thread was automatically locked due to age.
