Configuring Subdomains & Ports in Proxmox Network for VM Accessibility

[DubstepDude]

Hello,

First, let me explain the setup of my server and network. I own a Fujitsu Primergy RX300 S8 with Dual Xeon E5-2650v2 processors and 384 GB ECC Buffered RAM. We have Proxmox 8.1.4 and OPNsense 24.1.1 installed on this. It hosts VMs for me and colleagues where we run various programs. The first image shows my current network, and the second one illustrates how I envisioned it.

The overall goal is to make, for example, VM-1 accessible only via vm1.domain.com, and VM-2 via vm2.domain.com, and so on.

For instance, if three VMs are using port 7777 or 25565 for games like ARK, Terraria, or Minecraft, the idea is to access the servers by adding the subdomain, and possibly also ports that are not in use yet. (A user connects to vm2.domain.com, the game automatically adds the port, and the network redirects through the domain using a reverse proxy, proxy, or a similar method to the second VM in the network.)

The main reason is that some Game Server require the Query Ports from steam and i cant really devide up a port to multiple VMs at the same time on a single IPv4.

I've watched some videos about it, but I haven't managed to set it up correctly. I tried the tutorial of this person https://forum.opnsense.org/index.php?topic=23339.0, but that didn't really work for me. My plan was to have each subdomain with all ports available so that everyone can use all ports, considering we only have one IPv4 address.

How can I set this up? I tried using HAProxy, but I couldn't get it to work.

Example: (User1 tries to connect to vm2.domain.com and is being connected to the 2nd VM in the network. If he connects with the IP vm1.domain.com, he gets redirected to vm1 inside the network, the same for any other port pretty much, so I don't have to add every single port into the firewall myself.)

Best regards, DubstepDude

[Monviech (Cedrik)]

Have you considered using IPv6? Because you can get this to work with IPv6 easily since every device will have it's own GUA. No need for complicated setups with Layer 4 Bitstream Reverse Proxying.

[DubstepDude]

I do have Dual Stack so using an IPv6 would not be a problem, the only problem is my skill issue in setting that up since i dont have any knowledge but a rough plan on what i want it to do.

[cookiemonster]

I'm not sure you'll be able to accomplish this without manual intervention on the firewall or some custom automation of your own.
The requirement goes against the whole principle on which firewalls operate: do not allow incoming connections from an untrusted network (the WAN) into ports that haven't been allowed explicitly by the aministrator, nor open them automatically.