I have a domain, static IP address and many devices I'd like to access outside my house. How do I route them?

Question

I have a domain (e.g. example.com), static IP address (e.g. 212.5.5.5) and local devices at 192.168.0.1:80, 192.168.0.2:80, 192.168.0.3:80, 192.168.0.4:80, 192.168.0.4:47 (this one is not a website).

How do I access these devices using subdomains (for example, device1.example.com, device2.example.com, etc.)?

Currently I was only able to get example.com:80 and example.com:47 working, which point to 192.168.0.4:80 and 192.168.0.4:47.

I know that you cannot set the port on DNS server.

How I should overcome my problem?

Answer 1

You can have one public facing server running nginx reverse proxy that redirects traffic based on subdomain to the correct server.

nginx configuration on your "main" server:

server {
  server_name device1.example.com;
  location / {
    proxy_pass http://192.168.0.1:80;
  }
}
server {
  server_name device2.example.com;
  location / {
    proxy_pass http://192.168.0.2:80;
  }
}
server {
  server_name device3.example.com;
  location / {
    proxy_pass http://192.168.0.3:80;
  }
}

Answer 2

You'll need to use alternate ports for everything except one of them. For example, 212.5.5.5:80 would forward to 192.168.0.1:80, but then 212.5.5.5:81 would forward to 192.168.0.2:80, and 212.5.5.5:82 would forward to 192.168.0.3:80, and so on. This should be configurable on most modern NAT devices.

Another way, if you're willing to use IPv6, is just turn on IPv6 pass-through on your NAT device or router. That basically exposes every IPv6 address on your LAN to the public internet, letting you access them directly from the outside. As you might imagine, there is some risk associated with this. It's up to you to decide if that risk is tolerable.

Answer 3

You shouldn't expose these services to the internet directly. You can't audit these devices to be sure they are secure, and merely exposing them leaks information about the state of your internal network.

The correct solution is to set up a VPN server that grants you remote access to an internal network. Ideally the internal network should be segregated from your main one, only used for these exposed devices. That limits the damage if they are hacked.

Open source VPN software is mature, audited and the security issues are well understood. You limit yourself to a much smaller attack surface.

Answer 4

If you have only one external IP address, then:

The first thing is to differentiate my port, you seem to have done this.

Next for all the port 80s, you can use nginx as a reverse proxy to route traffic to the various places. You can tell it exactly what you asked for e.g. route http://device1.example.com to 192.0.0.1:80 etc. An alternative is to route http://example.com/device1 to 192.0.0.1:80.

To do the first way see virtual hosts, in the nginx manual.

You will also have to point all of the names to the external IP address, if using the virtual host method. Or just the base domain, if using the directory method.

Answer 5

You could first make sure everyone needs to access these services from Internet (= that they are truly intended to be public). Otherwise you could consider setting up a VPN server and access the services inside your network.

I assume that the services which are on port 80 are web servers providing typical web services. In such a case the reverse proxy solutions suggested in other answers apply.

It may be that they are services which are prepared/intended to run with a SRV entry in your DNS. The idea is that you resolve a well-known record for a service, which in turn gives you the name:port to connect to. To take the example of Minecraft:

• you set up your client to connect to minecraft.example.com
• your client knows that it can query _minecraft._tcp.minecraft.example.com. to get the actual IP and port to connect to.

This is an extremely useful feature but it has to be implemented on the client for the service you are accessing

Answer 6

If you want exactly what you described, the answer by Daniel is correct - you have to up set another server, make it receive all the :80 traffic and proxy it to the correct server depending on domain.

But I would suggest to simply get another IP address. Judging by your comments it seems that you are using some local ISPs and you have multiple of them to choose among in the neighborhood. Smaller ISPs in a competitive situation are very likely to agree on whatever. As long as you doing something legal, most of them will agree to give you an additional IP address for a couple of euros per month.

Another option is to just use one server. If your :80 servers are virtual machines on the same host, you will save resources and reduce complexity by making a single webserver with multiple virtual hosts serving it all.