HTTPS Redirect to different internal IP's

KOM

Sure, but that's more of a DNS issue and not a routing issue.

NoNameNone

@KOM:

Sure, but that's more of a DNS issue and not a routing issue.

Forefront TMG could do this, nothing to do with DNS.

3 URLS,s would hit the public IP on the TMG server and the Firewall would redirect each to the internal IP required.

KOM

Forefront TMG could do this, nothing to do with DNS.

Resolving a hostname to an IP address has nothing to do with DNS? OK then.

Stop thinking about how TMG would do it. If you want FQDNs to be resolved to their internal IP address, then update your internal DNS so it resolves these properly, or enable NAT Reflection and continue to use their external IP addresses.

NoNameNone

Maybe ive explained it wrong.

All 3 external FQDN's point to a single static EXTERNAL ip address on the pfsense Firewall.

Now depending on the FQDN, I want each to point to a specific IP on the LAN, so…..

https://Server1.domain.com ----------\ /----------- 192.168.0.1 (Server1) on LAN
https://Server2.domain.com ----------- Public IP on Firewall ------------ 192.168.0.2 (Server2) on LAN
https://Server3.domain.com ----------/ ----------- 192.168.0.3 (Server3) on LAN

Only port in use is HTTPS (443)

Hope the above better explains it

KOM

Your explanation was good enough the first time. My advice is still valid. Update your internal DNS so those domains resolve to the 192.168.0.x addresses. It's that simple.

doktornotor

Use haproxy with SNI. Done.

johnpoz

yeah you need to use a reverse proxy for that sort of thing.

KOM

Disregard pretty much everything I said. I completely missed that you were coming in from WAN, not LAN.

NoNameNone

@doktornotor:

Use haproxy with SNI. Done.

Many thanks for your help.

Can I add haproxy to our current squid proxy\port forwarding setup without causing any issues?

Thanks again

NNN

doktornotor

You need just one reverse proxy (and really only one can listen on a particular IP/port combination). Are you already using Squid as reverse proxy?

NoNameNone

@doktornotor:

You need just one reverse proxy (and really only one can listen on a particular IP/port combination). Are you already using Squid as reverse proxy?

At the moment, we are using it as a Forward proxy

doktornotor

Well then there's no problem with that. (Would stronly suggest to exclude the servers from Squid.)