Installing and configuring a second instance of Virtualmin on NAT and same public IP

SYSTEM INFORMATION
OS type and version AlmaLinux 9.4
Webmin version 2.303
Virtualmin version 7.30.8
Webserver version Apache version 2.4.62
Related packages SUGGESTED

I am trying to migrate all of my websites from centos 8.5 to Alma Linux 9. Currently my production sites are on Centos. I would like to create a second virtualmin for testing and migrating my production sites over to the new instance. All of my VMs are on a LAN in the 10.0.0.xx subnet. My current virtualmin install is on 10.0.0.67 (production) and I have installed the new instance on 10.0.0.71. Both instances use the same public ip (xx.xx.xx.177) but there is a conflict even though I port forward 10.0.0.71 to port 8080.

Clearly I need to configure virtualmin to handle the new webserver traffic and clear up the conflict, any suggestions?

NOTE: Firewall for port forwarding is pfsense

That sounds backward. You need to port forward port 8080 (external) to port 80 (and maybe 8443, if you’ll be testing HTTPS as well on the dev/testing instance).

You can’t have port 80 forwarded to two different internal addresses.

I don’t think that’s clear. I think you’ve got a routing problem, not a Virtualmin problem.

10.0.0.67 port forwards to 80 and 443 thats my production virtualmin server
10.0.0.71 port forwards to 8080 - > migrating virtualmin server

I have multiple vms that port forward to mail ports, ftp ports and several other vms. So is there any way to setup two instances virtaulmin on the same ip address?

The way you’re saying that sounds backward. Your public IP should port forward port 80 to port 80, and port 443 to port 443 on the production Virtualmin server.

Also sounds backward. Your public IP port 8080 should forward to port 80 on the Virtualmin server (and 8443 to port 443 on the Virtualmin server). It doesn’t make sense to forward to 8080 on the Virtualmin server because nothing on the Virtualmin server would be configured to listen there.

The way you’re doing it works, as long as you’re not expecting both to be forwarded from the same port. You can’t have port 80 going to both Virtualmin instances via routing alone. (You could have a proxy, such as Apache or nginx, in front that decides which backend IP to connect to based on the host header, but it sounds like you’re trying to do this on a router, which presumably can’t run Apache or nginx. Your router doesn’t interact with layer 7 details like the host header, so it has no idea what backend the packet should go to.)

You don’t need to port forward your new server while testing as it is on the same network.

Also you probably need to use splitdns while testing your new server or just use localhost records.

That’s what I do for my Dev server when needed.

Have a look at my notes. I cannot remember where i configured all of the NAT, splitDNS and NAT reflection, but they are there:

Yeah sorry Joe - correcting my terminology

Can forward 80 and 443 to 10.0.0.67 - Virtualmin instance 1 works great

Forwarding 8080 to instance 2 virtualmin installed on 10.0.0.71 - not working.

But if instance 2 is installed on 10.0.0.71 should it not pick up any virtual servers that I have created there: for example : test.mynewwebsite.net (installed on instance 2)?

Trying test.mynewwebsite.net:8080

Thanks shoulders I will have a look. Not familiar with splitdns. Have used nginx proxy manager with good success but I have not installed it in this environment and didnt want to go there if I could help it.

I don’t think so. Pfsense does not route based on domain also how have you given it a list of where to send traffic, that is what a load balancer would do but that is one entry point.

Damn! my bad! it all works had to open the firewall to accept port 8080. Duh…sorry

1 Like

I would not open port 8080 for testing it is completely pointless.

Use NAT reflection or splitdns, swap port 80 on pfsense port forwarding (NAT) when you want to use the new server.

On a pfsense router you can configure haproxy or nginx proxy to load balance and send traffic to either (or both) servers based on domain name.
Rather than use port forwarding