HTTPS Redirect to different internal IP's

NoNameNone

Hi, new to Pfsense, but enjoying it since replacing our old TMG server.

I want to be able to redirect external URL's to internal IP's (if possible) over HTTPS (Port 443) using a single static public IP address.

i.e.

a.domain.com to 192.168.0.1
b.domain.com to 192.168.0.2
c.domain.com to 192.168.0.3

Is the above possible?

Thanks in advance

NNN

KOM

Sure, but that's more of a DNS issue and not a routing issue.

NoNameNone

@KOM:

Sure, but that's more of a DNS issue and not a routing issue.

Forefront TMG could do this, nothing to do with DNS.

3 URLS,s would hit the public IP on the TMG server and the Firewall would redirect each to the internal IP required.

KOM

Forefront TMG could do this, nothing to do with DNS.

Resolving a hostname to an IP address has nothing to do with DNS? OK then.

Stop thinking about how TMG would do it. If you want FQDNs to be resolved to their internal IP address, then update your internal DNS so it resolves these properly, or enable NAT Reflection and continue to use their external IP addresses.

NoNameNone

Maybe ive explained it wrong.

All 3 external FQDN's point to a single static EXTERNAL ip address on the pfsense Firewall.

Now depending on the FQDN, I want each to point to a specific IP on the LAN, so…..

https://Server1.domain.com ----------\ /----------- 192.168.0.1 (Server1) on LAN
https://Server2.domain.com ----------- Public IP on Firewall ------------ 192.168.0.2 (Server2) on LAN
https://Server3.domain.com ----------/ ----------- 192.168.0.3 (Server3) on LAN

Only port in use is HTTPS (443)

Hope the above better explains it

KOM

Your explanation was good enough the first time. My advice is still valid. Update your internal DNS so those domains resolve to the 192.168.0.x addresses. It's that simple.

doktornotor

Use haproxy with SNI. Done.

johnpoz

yeah you need to use a reverse proxy for that sort of thing.

KOM

Disregard pretty much everything I said. I completely missed that you were coming in from WAN, not LAN.

NoNameNone

@doktornotor:

Use haproxy with SNI. Done.

Many thanks for your help.

Can I add haproxy to our current squid proxy\port forwarding setup without causing any issues?

Thanks again

NNN

doktornotor

You need just one reverse proxy (and really only one can listen on a particular IP/port combination). Are you already using Squid as reverse proxy?

NoNameNone

@doktornotor:

You need just one reverse proxy (and really only one can listen on a particular IP/port combination). Are you already using Squid as reverse proxy?

At the moment, we are using it as a Forward proxy

doktornotor

Well then there's no problem with that. (Would stronly suggest to exclude the servers from Squid.)