How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN Applicable Version: 10.6.2 onwards Overview Virtual host implementation is based on the Destination NAT concept. Virtual Host maps services of a public IP Address to services of a host in a private network. In other words, it is a mapping of public IP address to an internal IP address. This virtual host is used as the Destination address to access internal or DMZ server. A Virtual host can be a single IP address, an IP address range, a Cyberoam interface or any of these mapped to a Fully Qualified Domain Name (FQDN). Cyberoam automatically responds to the ARP request received on the WAN zone for the External IP address of Virtual host. Scenario Two (2) Web Servers, 10.10.10.5 and 10.10.10.15, are deployed in the DMZ. Users on the Internet accessing the FQDN www.example.com are to be directed to these Web Servers. Requests to this website are routed to Cyberoam's WAN Interface 1.1.1.1. Cyberoam is required to forward this traffic to the Web Servers. To fulfil this requirement, create a Virtual Host in Cyberoam of the FQDN www.example.com. Configure Static DNS Host Entry to ensure that the FQDN resolves to the internal IP addresses assigned to Web Servers.
Configuration You must be logged on to the Web Admin Console as an administrator with Read-Write permission for relevant feature(s). Step 1: Create Static DNS Host Entry Go to Network > DNS > DNS Host Entry and click Add to add a host entry as shown below. This entry enables Cyberoam to resolve DNS queries of www.example.com to corresponding internal IP Addresses. Click OK to save host entry. Step 2: Create Virtual Host Create Virtual Host to public access to internal servers using FQDN www.example.com. To create Virtual Host, go to Firewall > Virtual Host > Virtual Host and click Add to add a host as per parameters given below. Parameter Value Description Name IP Family VH_ExampleWebServer Name to identify the Virtual Host. IPv4 Select the IP Family to create the Virtual Host The IP address through which Internet users access the internal server/host. Available Options: External IP PortB 1.1.1.1 IP Address Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, appliance uses round robin algorithm to load balance the requests. IP Range Specified IP Address Range is mapped to a corresponding range of mapped IP Address. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.
Interface IP Select when any of the appliance Port, Alias or Virtual LAN (VLAN) sub interface is required to be mapped to the destination host or network. The IP Range of the internal servers/hosts. Available Options: IP Address External IP Address is mapped to the specified IP Address. Mapped IP www.example.com IP Range External IP Address Range is mapped to the specified IP Address Range. IP List External IP Address is mapped to the specified IP list. FQDN External IP Address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN. Physical Zone DMZ Port Forwarding Enable Port Forwarding Enabled Protocol TCP External Port Type Port External Port 80 Mapped Port Type Port Mapped Port 80 Note: Load Balancing and Health Check can only be configured on an IP Range, IP List or FQDN. LAN, WAN, DMZ, VPN or custom zone of the mapped IP address(s). For example, if mapped IP address represents any internal server then it is the zone in which server resides physically. Click to enable service port forwarding. If Port Forwarding is enabled, following options are available. Select the protocol TCP or UDP that you want the forwarded packets to use. Click to specify whether port mapping should be single or range of ports. Specify public port number for which you want to configure port forwarding. Click to specify whether port mapping should be single or range of ports. Specify mapped port number on the destination network to which the public port number is mapped.
Click OK to save host. Step 3: Create Firewall Rule(s) to Allow Access to Web Servers from Other Zones On clicking OK, the Add Firewall Rules For Virtual Host screen appears which enables you to create rules to allow access to the Web Servers from other zones. Enable Add Firewall Rule(s) For Virtual Host. Set rule parameters as desired. Here, we have created a rule which allows access to the Web Servers from WAN zone. Select Yes for Create Reflexive Rule.
Click Add Rule(s) to save the rules. The above configuration allows access of the internal servers using FQDN. Document Version: 1.0 13 November, 2014