apache 2.2 - LXC and port overlapping

I've done a lot of searching on Google and browsed what I could find on Server Fault, but can't find any solution to this.

I have a server that is running LXC containers (2 for right now, both Ubuntu). The LXC network is bridged (10.0.3.0/24), with the DHCP server for it being at 10.0.3.1, and I'm using two IPs of that network: 10.0.3.2 (container 1 [CN1]) and 10.0.3.3 (container 2 [CN2]).

I have Apache set up on both, and I have a subdomain set up on DNS for a website of mine that points to my public IP (web1 -> CN1 and web2 -> CN2). The subdomains resolve correctly, but here is where the problem starts.

Depending on which rule I have first in iptables determines which container is hit with the webpage. So if I have external port 80 hit CN1 first, then that index.html file is shown, and if 80 is set for CN2 first, then that index.html file is shown.

What I thought I'd do is set the Apache servers to listen on a different port, so I set CN1 to listen on 801 and CN2 to listen on 802, then I set up iptables to route route external port 80 to both of these, but the same issue still arises.

My ultimate goal is to have web1 and web2 display their respective index.html files without specifying a specific external port (i.e.: ip:81->CN1 and ip:82->CN2). Only other thing I can think of is set up a proxy (i.e.: nginx) on the host and have it proxy requests based on the (sub)domain requested, but I'd rather not do that if possible.

iptables rules:

NAT table

root@SKYNet:~# iptables -t nat -L  
Chain PREROUTING (policy ACCEPT)  
target     prot opt source               destination  
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:10.0.3.2:801
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:10.0.3.3:802

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.0.3.0/24          anywhere

Default table

root@SKYNet:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I do understand the logic of iptables and routing it to one point, but I thought iptables would basically try to direct the packet to port 801, and if it doesn't match the VHost it'll reject it and iptables will go to the next one (802 in this case).

Answer

iptables is doing its job. iptables has no idea of what is HTTP if your targeting the same port, only the first rule will match whatever happens to the request afterwards.

The only way to achieve what you need is to setup a reverse proxy which will get all HTTP requests and redirect them to the correct HTTP server depending on the host name.