Linux – Reverse Proxy multiple internal FTP Servers

apache-2.2centosftplinuxPROXY

I have setup a reverse proxy for http using Apache mod_proxy like this:

  • Client > http:/abc.domain1.com > Reverse Proxy Server > 192.168.50.1 (Internal Server)

  • Client > http:/def.domain2.com/ > Reverse Proxy Server > 192.168.50.2 (another internal Server)

Now I want to acheive the same for FTP:

  • Client > ftp:/abc.domain1.com/ > Reverse Proxy Server > ftp:/192.168.50.1 (internal FTP Server)

  • Client > ftp:/def.domain2.com/ > Reverse Proxy Server > ftp:/192.168.50.2 (another internal FTP Server)

Both internal FTP Servers are running vsftpd. Please let me know the setup for Redhat/Centos.

Reason: I have only one public IP available.

Best Answer

There are two problems to set up what you are looking for:

  • unlike for http, reverse proxies for ftp are a pretty rare breed and those that exist (like the old Suse proxysuite) are - to remain polite - not really a joy to set up and work with.
  • unlike http 1.1, ftp has no provisions for virtual hosting, meaning that a server cannot see the hostname you want to talk to.

Here are two potential alternative solutions that are relatively easy to set up, each with its own advantages and limitations

  1. serve the two backend server on different ports (eg ftp://abc.domain1.com/ and ftp://def.domain2.com:8021/. pretty easy to setup and no reverse proxy needed, just some extra ports to forward. Disadvantage: one of the domains will have to use the url including the port number, which may or may not be an issue for you.
  2. CrushFTP is a commercial but reasonably priced server for ftp, sftp, etc that can easily be set up to front multiple backends in a number of ways:
    1. as directories, which would lead to a setup like ftp://abc.domain1.com/abc and ftp://abc.domain1.com/def.
    2. show a specific backend based on the user profile, so ftp://abc.domain1.com/ would look completely different depending on who logs in.

We chose option 2 because in daily operations it proved the most flexible and reliable. As an added bonus it allows you to use other protocols than ftp for the traffic to your backends, eg sftp.

They have a fully working demo version that you can download and test with (iirc it's limited to 5 concurrent connections).

Only potential downside: it's a Java program, so it's footprint (both disk and memory) are a size bigger than that of a regular ftp server.

Related Topic