SSL on multiple sites in a virtually hosted WinServer 2003
- From: "Electric Bliss" <tonyz@xxxxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 19 Mar 2007 15:12:47 -0600
Greetings,
I have searched long and hard and I still don't know the best solution. I
hope someone can help.
Here's my current situation:
I have a block of 5 public ip addresses. I have a Cisco 670 doing PPoE with
my ISP and its address is the public gateway.
I have a Linksys firewall connected to the Cisco and its wan port is set to
one of the public ip addresses.
I have a Windows 2003 web server behind the Linksys. I am forwarding HTTP
and SSL to it.
I am hosting several websites (virtually with host headers) on the server.
Here is my current challenge:
This setup works fine for only one SSL enabled site. If I enable another
site for SSL over port 443 then IIS uses the certificate from the first
site. The user then sees that the cert isn't correct, as it's pointing to
the wrong site's cert.
As a quick work-around I have forwarded another port to the server and am
using that for the second site's SSL. This works fine EXCEPT that some users
have a firewall that blocks SSL activity on ports that aren't 443.
Here is my attempted solution:
Installed a second Linksys router and set its wan ip address to another one
of my public ip addresses. (Both routers are now plugged into a small switch
with the cisco each of their wan addresses is a different public ip.)
Installed a second nic for my server and plug it into the second Linksys. So
here is what the topology looks like:
ISP
|
|
Cisco 670 (ip address is public gateway)
|
|
4-port switch -----|
| |
| |
Linksys1 Linksys2
(wan public ip1) (wan public ip2)
(lan 192.168.44.1) (lan 192.168.55.2)
| |
| |
Server nic 1 Server nic 2
Now I can set my second site to respond to HTTP and SSL requests on the
second nic (with the standard SSL port). This works fine, EXCEPT my websites
now intermittently "vanish" from outside hosts.
The only reason I can think this would be happening is that Windows isn't
capable of having more than one gateway. So it will establish a session on
one of the nics but it gets confused as to which gateway to send the packets
back out on. (I have no idea if this is the problem or not but the fact is
this solution isn't working and I would love to know why.)
Seems to me that Windows should recognize that a connection was established
on a particular nic and it should send the packets (that belong to that
session) back through the nic they came in on, through its gateway (the
corresponding Linksys), and out to the client.
Someone told me that there is no way to do this and that I'd have to make my
server a bastion host so that I have only ONE nic, with multiple public
addresses assigned to it, and only ONE default gateway (the cisco's ip# (the
public gateway address)).
I have avoided the bastion host solution because I want my server to be
behind a hardware firewall.
So here are my current questions:
1. Is my current solution just a pipe-dream? Is this even do-able? If so,
why are my websites vanishing? What am I missing in my setup to make this
happen?
2. Someone mentioned Sonicwall TZ 170 might be a (costly) solution. Is there
a hardware/firewall/router/gateway that does nat with multiple public ip
addresses that would solve this?
3. An even better question than those might be: what is the best solution
for what I am trying to do?
Sincerely,
Tony
.
- Follow-Ups:
- Prev by Date: Re: Really slow SMB transfers, event log full of EFS problems.
- Next by Date: Re: WHY WINS
- Previous by thread: Re: a list of ip addresses in use
- Next by thread: RE: SSL on multiple sites in a virtually hosted WinServer 2003
- Index(es):
Relevant Pages
|
