How to NAT based on FQDN behind another router

zizounet

This is what i have

|  https://url1.domaine.com (dns to WANIP)

|  https://url2.domaine.com (dns to WANIP) 

|  https://url3.domaine.com (dns to WANIP)

|  https://url4.domaine.com (dns to WANIP)   

     | 

 | WANIP = public static WAN ipv4

 |

 ------------------------

  FREEBOX mode routeur DMZ set to 192.168.1.253

 ------------------------

 |

 192.168.1.254

   |

 |

 192.168.1.253

   |

 ------------------

SONICWALL TZ270 

 ------------------

   |__ 10.1.1.254 lan gw  port 8443

 |___ 10.1.1.1 serveur1 port 7777

 |___ 10.1.1.2 serveur2 port 8888

 |___ 10.1.1.3 serveur3 port 9999

   

 and i like to allow accès from WAN to  https://url1.domaine.com map to 10.1.1.1;7777

 and i like to allow accès from WAN to  https://url1.domaine.com map to 10.1.1.2;8888

  

BWC

@zizounet short answer, you can't because NAT is not SNI based. You need to get yourself a reverse proxy.

https://community.sonicwall.com/technology-and-support/discussion/comment/3514#Comment_3514

--Michael@BWC

preston

Hi @zizounet , you would need to use PAT create a NAT rule for each on the SonicWall in the NAT rules

Important make sure you change the HTTPS management port first if enabled on the WAN Interface to another port like 444

in your first example as below :

Original Source = ANY - Translated Source = Original

Original Destination = set to the destination FQDN ( https://url1.domaine.com)

Translated Destination = 10.1.1.1

then set the Original Service = HTTPS and set the Destination Service = 7777

Access Rules - In the WAN to LAN access rules Source (ANY) Destination (your SonicWall WAN IP) add the Translated Ports i.e.7777 to the Destination service, do not change the Source Port on the rule

How to Set up PAT below :

https://www.sonicwall.com/support/knowledge-base/how-can-i-configure-port-address-translation-pat-or-port-redirection/170505515124447/

you may also need to create port forwarding on your freebox to the (DMZ IP) SonicWall WAN IP for HTTPS, I know on my Orange Live box even though I have the DMZ option enabled it still requires me to add the NAT rules for each service I'm forwarding to the SonicWAll.

preston

@zizounet the above doesn't work as expected, I need to do some further testing

MustafaA

As @BWC highlighted the requirement cannot be fulfilled as is, since the NAT policies are not based on SNIs (Server Name Indicator). You have two options;

1. Use reverse proxy, or
2. Give each URI a distinct port so that it can be translated to the internal IP-Port pair

preston

@MustafaA , Yes I realised after I wrote the comment, but it doesn't let you delete your own comments