HTTPS Redirect to different internal IP's

[KOM]

Sure, but that's more of a DNS issue and not a routing issue.

[NoNameNone]

@KOM:

Sure, but that's more of a DNS issue and not a routing issue.

Forefront TMG could do this, nothing to do with DNS.

3 URLS,s would hit the public IP on the TMG server and the Firewall would redirect each to the internal IP required.

[KOM]

Forefront TMG could do this, nothing to do with DNS.

Resolving a hostname to an IP address has nothing to do with DNS?  OK then.

Stop thinking about how TMG would do it.  If you want FQDNs to be resolved to their internal IP address, then update your internal DNS so it resolves these properly, or enable NAT Reflection and continue to use their external IP addresses.

[NoNameNone]

Maybe ive explained it wrong.

All 3 external FQDN's point to a single static EXTERNAL ip address on the pfsense Firewall.

Now depending on the FQDN, I want each to point to a specific IP on the LAN, so…..

https://Server1.domain.com ----------\                                /----------- 192.168.0.1 (Server1) on LAN
https://Server2.domain.com ----------- Public IP on Firewall ------------ 192.168.0.2 (Server2) on LAN
https://Server3.domain.com ----------/                                ----------- 192.168.0.3 (Server3) on LAN

Only port in use is HTTPS (443)

Hope the above better explains it

[KOM]

Your explanation was good enough the first time.  My advice is still valid.  Update your internal DNS so those domains resolve to the 192.168.0.x addresses.  It's that simple.

[doktornotor]

Use haproxy with SNI. Done.

[johnpoz]

yeah you need to use a reverse proxy for that sort of thing.

[KOM]

Disregard pretty much everything I said.  I completely missed that you were coming in from WAN, not LAN.

[NoNameNone]

@doktornotor:

Use haproxy with SNI. Done.

Many thanks for your help.

Can I add haproxy to our current squid proxy\port forwarding setup without causing any issues?

Thanks again

NNN

[doktornotor]

You need just one reverse proxy (and really only one can listen on a particular IP/port combination). Are you already using Squid as reverse proxy?

[NoNameNone]

@doktornotor:

You need just one reverse proxy (and really only one can listen on a particular IP/port combination). Are you already using Squid as reverse proxy?

At the moment, we are using it as a Forward proxy

[doktornotor]

Well then there's no problem with that. (Would stronly suggest to exclude the servers from Squid.)