dynamic dns issue

How did you resolve this on UTM? 

What do you mean?

Sorry, thought that one example will be enough.. 

Please see below the other two:

Here is Pyload (will be replaced with emby in XG)

The Real Webserver part

And this is the Virtual webserver part

And finally the "root" one which is on port 80

Real:

Virtual

The way it was working was this:

When I hit from the browser http://srv.ddns.net I was getting to port 80 of the InsomniaWebSRV 

When I hit from the browser https://srv.ddns.net:4444 I was getting to sophos UTM webadmin page

When I hit from the browser https://srv.ddns.net I was getting to sophos UTM portal

When I hit from the browser http://motion.ddns.net I was getting to the motioneye login page which was hosted on port 8096 of InsomniaWebSRV 

When I hit from the browser http://pyload.ddns.net I was getting to the pyload login page which was hosted on port 8000 of InsomniaWebSRV 

As I mentioned already, all dyndns names should lead to the same server, just different ports.

Just to test, I tried something else. I created a different web server which leads to an openspeedtest docker on my synology nas

So the webserver is a completely different ip address.

Entering the DDNS hostname again redirected me to the first webserver again on port 80, which is rather strange

So a question, just so that it is written here... In network -->DDNS I have entered all 3 of those dyndns names..

Do they need to be removed from there? And only add them in the WAF settings?

(which does not make much sense, of course, since the needed authentication for dyndns only exists in Network-->Dynamic DNS tab)

Ok, update post just to say that I did remove them and it was still redirecting to port 80 of the server, but since dns is involved here, my guess is that when they are removed and noip gets no updates they will simply redirect to nowhere...

Anyway, is there anyone with a scenario like this who can confirm that it is working? 

Does anyone need any additional info about my setup in order to help find out what the issue is?

thanks! 

Can someone please offer some insight?

Should I try a factory reset or something? Setting all the stuff I have once more it will be quite a task, but I really don't know what else to try. This specific task should be the simplest one. But it is not working for me..

I am currently thinking, this is not possible in SFOS. Based on the integration of the services, the web app will be hosted on IP base, not SNI. 

Can you please explain what you mean?

The UTM separate the request (FQDN) based on SNI. Server Name Identification. It looks like, SFOS cannot do this. 

So how can it be used as a reverse proxy? Only with path specific routing? 

You tested several ways. And as your results, it seems not to work based on FQDNs. Therefore you cannot do your setup. 

I see what you mean.. But the thing is that it is accepting FQDNs in the firewall rule and looking at the documentation I cannot understand that this is not supported..

XG was supposed to be one step up in the reverse proxy rule compared to UTM. Is it really one step back? What I mean is, are we sure that there is not something wrong in my software setup?

Do you have some inside info perhaps? Is this something that is going to be fixed in a later release?

Thanks a lot man!

EDIT: Do you think I should create a new post describing exactly this and asking for verification that it can actually be done?

I see what you mean.. But the thing is that it is accepting FQDNs in the firewall rule and looking at the documentation I cannot understand that this is not supported..

XG was supposed to be one step up in the reverse proxy rule compared to UTM. Is it really one step back? What I mean is, are we sure that there is not something wrong in my software setup?

Do you have some inside info perhaps? Is this something that is going to be fixed in a later release?

Thanks a lot man!

EDIT: Do you think I should create a new post describing exactly this and asking for verification that it can actually be done?

It could potentially work, if you define the domain per WAF Rule. 

So this should work, and separate the Domains like UTM did. 

Thanks for taking time trying to help me !

I think I have already tried this but it does not hurt to give it another try, I guess

I will post back

Quick reply..Did it

Nope as a first try it is not working.. Both FQDNs forward to port 80 of the server. Did it actually work for you in your tests?

However as a workaround I had created some NAT rules that might interfere (?) Those two are the two first ones, though..

I will try more and perhaps later do as I mentioned above and try to create a new post to explain what I need to do and ask if it is doable... If you have any other ideas, they are welcome!

I really appreciate your help!

DNAT will grap the traffic of the WAF. 

OK, so it will interfere..BUT I disabled all related NAT rules and I still get the same result... 

Then it seems not to be supported on SFOS. 

Nevertheless I will try my luck getting an "official" answer (from the support maybe?)

I will create a detailed post to describe the situation and see what I get. I really can't believe that it is not working. It was a piece of cake with the UTM...

I really feel at this point that my decision to drop it and go to XG has dropped me a few steps backwards..

I will admit, though, that working with web policies is much better in XG.. now, detailed reporting, live internet usage and other staff that are missing from XG is a different discussion, but about those I knew and expect to be added/improved  in the future..

Sophos Support is not involved for Home User. 

For the future, such concepts are ZTNA concepts. But this is not available for Home users. 

Yes I understand I am a home user, but I don't want them to "support" me.. Just an answer whether this can be done or not..

LuCar Toni said:

For the future, such concepts are ZTNA concepts.

What do you mean?

www.sophos.com/.../zero-trust-network-access