Running two web sites on different ports

[David44]

We have a site https://blah.schoolname.org/ that runs on port 443. This is hosted onsite and we have a port forward rule on Smoothwall to forward HTTP and HTTPS (or port 80 and port 443) traffic to the internal webserver. This works fine. The same server also has another site running on it, using port 8181, This second site works internally, so I know the webserver part is configured correctly but I can't/don't know how to get it working externally. I want the external user to be able to visit https://blah.schoolname.org:8181 and see the second site. Currently they see nothing but a browser generated time-out error.

 

I have tried adding a "Port 8181" service object that contains HTTP, HTTPS and a TCP Port 8181 service that I created, and adding it to the working port forward rule but the site on port 8181 will not load. I can't see anything on the firewall logs, literally, not even a dropped or rejected request.

 

Is it possible have two web sites served externally using the same subdomain but different ports with Smoothwall? If so, what might I be doing wrong?

[Davit2005]

Can your firewall do packet captures on interfaces?

 

These are sometimes more reliable in the fact you can see if the traffic hits the firewall at all on it's interfaces. Then workout if it is security or NAT/port forwarding issue. The firewall may be dropping the packet if it does not know what to do with it and it does not get as far as logging the traffic. But you can also see if it is reaching the firewall at all. i.e. being blocked by your ISP.

 

This has been a god send to us especially when third parties claim/swear blind it is something our side causing the issue, lol.

Edited April 30, 2024 by Davit2005

[OLdMan99]

Use the reverse proxy function would be a better option than port forwarding.

[mavhc]

Use the reverse proxy function would be a better option than port forwarding.

 

Also makes certificates easy, give the reverse proxy the *.something cert, and everything it proxies now has a proper cert

[dhicks]

We have a site https://blah.schoolname.org/ that runs on port 443. This is hosted onsite and we have a port forward rule on Smoothwall to forward HTTP and HTTPS (or port 80 and port 443) traffic to the internal webserver. This works fine. The same server also has another site running on it, using port 8181, This second site works internally, so I know the webserver part is configured correctly but I can't/don't know how to get it working externally. I want the external user to be able to visit https://blah.schoolname.org:8181 and see the second site.

 

As already suggested, it might be easier to have a reverse proxy in front of both internal sites. I've found Caddy to be very easy to use for this kind of thing:

 

https://caddyserver.com/

 

It does automatic HTTPS, sorting out getting a certificate from Let's Encrypt for you, so it can be easier to set up.

 

Otherwise, you could look at an ingress solution like Cloudflare's Zero Trust or Ngrok. These services give you an encrypted tunnel directly from the web server to their world-facing endpoint. Both these services also offer authentication via Google / Microsoft / etc accounts, so you can easily limit access to certain users if wanted. We've found Cloudflare to work nicely - their Zero Trust service is free for under 50 users, we're using it control access to an internal web-based application used by some of the admin staff.

[ZeroHour]

Use the reverse proxy function would be a better option than port forwarding.

 

This is the way.

There are quite a few options but Nginx is good, there is also a project for the task although I have not used it personally.

 

https://github.com/NginxProxyManager

[MCPearson]

I know you want to serve over different ports, but if it's possible you might find it easier to serve sites with different subdomains. Then you have all 443 requests come in to one web server and have the webserver serve different pages using virtual hosts.

[tom_newton]

It should be doable without different subdomains or a reverse proxy (which your smoothwall does have if you need it). If it's a browser timeout error that does sound like a misconfiguration somewhere. I would first check with your ISP - it is possible their firewall isnt allowing "non standard" ports in