Hostname-based (FQDN/SNI) NAT / Virtual Server on a single public IP: any news in uOS?

Options
Alex_91
Alex_91 Posts: 61
First Comment Friend Collector Eighth Anniversary
image  Ally Member
in USG FLEX H Series

Hello,

I have a USG FLEX H series behind an ISP router that forwards port 8443 to the firewall. I have a single public IP (45.23.1.1) and two DNS records pointing to it: test.it and test2.it. Both reach the firewall on port 8443 and I would like to route them to two different internal servers:

  • test.it:8443 → 10.10.1.5:8443
  • test2.it:8443 → 10.10.1.6:8443

From what I could find, NAT / Virtual Server only works at IP and port level and cannot distinguish traffic by requested hostname (HTTP Host header or TLS SNI). Previous discussions about USG/ZLD models suggested using a reverse proxy behind the firewall or different external ports.

Could you please:

  1. Confirm that on the H Series (uOS) it is not possible to do NAT or routing based on FQDN/SNI, even with SSL Inspection, Application Patrol or any other feature?
  2. If not available, let me know whether it is planned for upcoming releases or on the roadmap?
  3. Tell me whether there is an officially supported or recommended solution from Zyxel besides an external reverse proxy or using different ports?

Thank you.

Accepted Solution

  • Zyxel_Luna
    Zyxel_Luna Posts: 113
    5 Answers First Comment Friend Collector
    image  Zyxel Employee
    edited October 19 Answer ✓
    Options

    Hi @Alex_91,

    Thank you for the detailed description. Please find our answers below.

    1. FQDN/SNI-based NAT on the H Series (uOS)

    Your understanding is correct. On the USG FLEX H Series, NAT / Virtual Server rules match traffic only by IP address, protocol and port. Hostname-based forwarding (HTTP Host header or TLS SNI) is not supported, and uOS does not include a built-in reverse proxy.

    This is not possible with SSL Inspection or Application Patrol either. NAT decides which host to forward the traffic to when the first TCP packet (SYN) arrives, but the hostname only appears after the TCP handshake, in the TLS ClientHello (SNI) or the HTTP request (Host header). To route by hostname, the device has to terminate the connection first and then open a new connection to the correct server, which is the job of a reverse proxy.

    SSL Inspection and Application Patrol can inspect, allow or block traffic, but they cannot change the NAT destination.

    2. Roadmap

    Unfortunately, we currently have no plans to add hostname-based (FQDN/SNI) forwarding or a built-in reverse proxy to uOS.

    For this use case with a single public IP, we recommend the following:

    • Deploy a web reverse proxy behind the firewall (recommended).
    • Use different external ports. For example, test.it:8443 → 10.10.1.5:8443 and test2.it:8444 → 10.10.1.6:8443. This is the simplest setup, but users have to include the port in the URL.

    If you need any assistance, please let us know. Thank you.

All Replies

  • PeterUK
    PeterUK Posts: 4,796
    250 Answers 2500 Comments Friend Collector Ninth Anniversary
    image  Guru Member
    edited October 17
    Options

    I was thinking you meant something else but from what I read maybe not? I feature I was thinking of was NAT / Virtual Server to have FQDN support for Source IP

    so that you have rule 1
    Source IP example1.com DNS lookup 2.2.2.2
    External IP WAN1
    Internal IP 192.168.1.100
    Port Mapping Type
    External Port 80
    Internal Port 80
    rule 2
    Source IP example2.com DNS lookup 3.3.3.3
    External IP WAN1
    Internal IP 192.168.1.200
    Port Mapping Type
    External Port 80
    Internal Port 80

    but reading more to your post you likely need to use a reverse proxy like nginx

  • Zyxel_Luna
    Zyxel_Luna Posts: 113
    5 Answers First Comment Friend Collector
    image  Zyxel Employee
    edited October 19 Answer ✓
    Options

    Hi @Alex_91,

    Thank you for the detailed description. Please find our answers below.

    1. FQDN/SNI-based NAT on the H Series (uOS)

    Your understanding is correct. On the USG FLEX H Series, NAT / Virtual Server rules match traffic only by IP address, protocol and port. Hostname-based forwarding (HTTP Host header or TLS SNI) is not supported, and uOS does not include a built-in reverse proxy.

    This is not possible with SSL Inspection or Application Patrol either. NAT decides which host to forward the traffic to when the first TCP packet (SYN) arrives, but the hostname only appears after the TCP handshake, in the TLS ClientHello (SNI) or the HTTP request (Host header). To route by hostname, the device has to terminate the connection first and then open a new connection to the correct server, which is the job of a reverse proxy.

    SSL Inspection and Application Patrol can inspect, allow or block traffic, but they cannot change the NAT destination.

    2. Roadmap

    Unfortunately, we currently have no plans to add hostname-based (FQDN/SNI) forwarding or a built-in reverse proxy to uOS.

    For this use case with a single public IP, we recommend the following:

    • Deploy a web reverse proxy behind the firewall (recommended).
    • Use different external ports. For example, test.it:8443 → 10.10.1.5:8443 and test2.it:8444 → 10.10.1.6:8443. This is the simplest setup, but users have to include the port in the URL.

    If you need any assistance, please let us know. Thank you.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）