Home page logo
/

nanog logo nanog mailing list archives

Re: Common operational misconceptions
From: Jimmy Hess <mysidia () gmail com>
Date: Sun, 19 Feb 2012 19:09:49 -0600

On Sun, Feb 19, 2012 at 6:24 PM, Owen DeLong <owen () delong com> wrote:
I have 15 FTP servers and 22 web servers behind it.
I want people to be able to go to ftp://<hostname> and/or http://<hostname> for each of them.

For HTTP;  You put a device on that one IP that will accept each TCP
connection,  await the SNI or Host  header from the client,   and then
make/forward  the connection to a proper server for that hostname.
The public IP address belongs to the FTP/HTTP  "service"  instead of
belonging to a server.


For FTP,  send to a desired FTP server based on the login username or
otherwise make a SRV record for the  _ftp  service for each hostname,
 and   set aside a TCP port for each FTP service's control connection.

The   ftp://user@<hostname>   approach  or the
ftp://user@<basehostname>/<hostname>/  is  probably more convenient
than ftp://<hostname>:<1234>, since many clients do not support SRV
records.

The problem is with the FTP protocol not supporting virtual hosting,
though;  this missing FTP feature is not a NAT problem per se.

The VHOST problem was solved with HTTP a long time ago.
It's just that FTP is a lot less popular / fell into some disuse,  so
the deficiency  (lack of virtual hosting support)   was  never
corrected -- and the protocol hasn't had a single update in a long
time.

So you'll have to have a workaround to do 15 FTP servers with one
global IP,  because your circumstance is so unusual,  that's just
life.

--
-JH


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]