Port forward to different IP based on destination address in opnsense - eviltoast

cross-posted from: https://lemmy.world/post/14180956

Hello all you lovely people!

I’m trying to figure out if I can port forward to different servers based on the destination domain.

I have a domain with a wildcard cert and I’d like to be able to route all traffic headed towards “1.domain.com” to a server I’m calling “1”. I’d still like traffic headed to domain.com to go to where it’s currently going, we can call this server “0”, and to be able to have a 2.domain.com or 3 or 4 in the future.

I thought that having a port forward rule with: interface: WAN Protocol: any source: any destination: a url alias including 1.domain.com redirect target ip: local ip

Would work, but it doesn’t seem to. Any tips?

  • Max-P@lemmy.max-p.meEnglish
    3·
    7 months ago

    Your router has no idea what domain has been used for a given connection, it knows the IP and only the IP.

    HAproxy and NGINX can, because for HTTP you just need to look at the Host header, and for HTTPS, the SNI extension for TLS. Anything that uses TLS should be doable with HAproxy (you don’t even need to decrypt the content, just read the SNI and pass it through to the backend as-is).

    For other protocols, your only options are either it supports it, or you have to do multiple ports. Or a VPN at that point would also work, remove the problem entirely.