Let's Encrypt forward requests to the correct internal server (DNS-NAT)

[Sebastian757]

Hello,

We have successfully been running Let's Encrypt certificate renewals.
There is a security rule for Let's Encrypt IPs on port 80 to our web server's external IP addresses and corresponding NAT rules for forwarding to the internal web servers. This works very well.

Now, however, several internal web servers are hiding behind one external IP, all of which want to renew a Let's Encrypt certificate with different domains.

How do I set up a Checkpoint Security Gateway so that the requested domain is read from Let's Encrypt accesses and then forwarded to the correct internal web server?
You can specify domains or FQDNs in the NAT rule, but then you also have to specify a domain name for the destination. However, the name is then resolved using either the external or internal IP address and therefore doesn't match the external or internal object entry.

So, how can I filter and forward requests based on the requested domain?

[PhoneBoy]

NAT does nothing for the Layer 7 information inside of HTTP, only the IP headers.
In any case, this is more like Reverse Proxy functionality: https://support.checkpoint.com/results/sk/sk110348
Not sure it will work in this case, otherwise you're looking at an RFE.