Capability

Virtual Hosts

Separate multiple domains securely over a single VIP and a single port.

TR7 ADC's Virtual Hosts capability routes multiple domains on the same IP and port to distinct service pools. For TLS traffic the decision is made on the SNI value; for HTTP traffic on the Host header. Each domain can be bound to its own pool, its own security profile and its own operational policy. This model eliminates the requirement to allocate a separate public IP for every domain. Services such as `shop.example.com`, `api.example.com`, `admin.example.com` or `tenant1.app.com` can all share a single VIP while TR7 carries each incoming request to the correct pool based on the domain name. Wildcard domain support converts patterns like `*.example.com` into matching rules automatically. Multi-tenant SaaS platforms, customer subdomains and broad domain families can therefore be managed without writing individual rules for each entry. Virtual host configuration is generated deterministically: the same input always produces the same output. If nothing has changed, no reload is triggered; a soft reload is applied only when the configuration actually differs. Domain, certificate or pool changes are therefore applied without interrupting live connections.

2
Parallel routing modes: SNI for TLS, Host header for HTTP
500K
nofile ulimit per container — resilience for high connection counts
0
Connections dropped — soft reload on real configuration changes only

Managing a separate IP and a separate listener for each domain does not scale.

In traditional ADC and reverse-proxy architectures, every new domain usually means a new listener, a new virtual service, a new IP address or a complex set of routing rules. At small scale this is manageable, but once the domain count reaches dozens, tenants reach hundreds or multi-environment separation is required, the operational surface falls apart quickly.

On the TLS side the problem is sharper. The HTTP Host header is invisible until TLS is terminated, so routing TLS traffic to the correct service requires a decision at the SNI level — before the handshake completes. Without proper SNI separation, domains sharing the same IP cross paths, the wrong certificate is served or traffic lands on the wrong backend.

Wildcard domain management adds a further burden. Patterns like `*.tenant.app` are common in SaaS and MSP scenarios, yet manually defining every subdomain is not sustainable. The wildcard must be converted into the correct regex, properly escaped and constrained so it does not match unintended domains.

HTTP/2 and modern TLS semantics make mismatched domain handling even more sensitive. When SNI and the Host header disagree, the client expects well-defined behavior; if the platform cannot produce it, connections either land on the wrong pool or security controls are bypassed.

TR7 ADC treats virtual hosts as a domain + matcher + pool relationship. It separates domains on the same IP and port via SNI or Host header, handles wildcard domains automatically and binds each domain to its own service policy.

Our approach

TR7 removes manual listener duplication from virtual host management and handles domain-based routing through an object model, automatic matcher generation and a zero-downtime reload process.

Two matching modes: SNI and Host header

For TLS traffic the decision is made on the SNI value; for HTTP traffic the Host header is used. Both TLS early-separation scenarios and classic HTTP reverse-proxy scenarios are handled under the same virtual host model.

Wildcard domains are converted to matching rules automatically

Wildcard entries such as `*.example.com` are automatically converted to safe matching patterns. Operators do not write regex by hand. A single wildcard definition routes unlimited subdomains to the correct pool.

Each domain is bound to its own pool and policy chain

Every domain sharing a VIP can target a different pool. This means one domain can carry a WAAP profile, another mTLS, another a cache or custom log profile. Domain separation is not just routing — it is policy separation.

Deterministic configuration and idempotent reload

TR7 generates virtual host configuration in a sorted, deterministic order. Because the same input always yields the same output, unnecessary reloads are avoided. A soft reload is applied only when a real change is detected, preserving live connections.

Capabilities

Virtual Hosts provides domain-based separation, wildcard management, certificate binding, tenant isolation and zero-downtime updates on the same IP and port.

SNI-based virtual host routing

In TLS traffic the SNI value presented by the client is read and the matching domain is directed to the correct pool. This allows domain separation at the earliest stage of the TLS connection. It is the core mechanism for running multiple TLS services on a single port 443.

Host header-based HTTP routing

In HTTP mode TR7 uses the `Host` header value for virtual host matching. Classic vhost behavior is achieved for plain HTTP and for HTTP traffic after TLS termination. Different domains on the same IP and port are forwarded to distinct service pools.

Wildcard domain support

Wildcard names such as `*.example.com` are automatically converted into matching rules. Operators do not write a separate rule for every subdomain. This is especially powerful for SaaS tenant domains, customer subdomains and multi-environment separation.

Per-domain pool binding

Each virtual domain is bound to a pool ID. `shop.example.com`, `api.example.com` and `admin.example.com` on the same VIP can target different backends. Each pool manages its own backend list, health checks, WAAP and traffic rules independently.

Per-domain WAAP, cache and log profile

A virtual host is not just a routing decision — security and operational policies also diverge through the pool each domain is bound to. One domain can enforce a strict WAAP profile while another is accelerated with a cache profile. Log format and reporting can be configured per domain and pool.

Certificate and SNI alignment

When multiple certificates are in use on the same IP and port, TR7 runs the correct certificate-and-pool chain based on the SNI value. Wildcard certificates and wildcard vhosts can be used together, simplifying multi-domain TLS operations.

Proxy metadata chain is preserved

The virtual host layer supports forwarding client and geographic context information to downstream layers during traffic routing. Backend pools, logging, geo-based decisions and policy chains can therefore continue to use the required context after domain separation.

Pool tunnel socket architecture

The virtual host layer forwards traffic to the relevant pool over an isolated internal connection. This architecture performs domain separation at a central point while keeping each pool's workspace isolated. Traffic from a portal, AAM or another pool can be handled with the same model.

Zone-aware multi-tenant vhost management

In multi-tenant deployments each zone manages its own virtual host list. One tenant's domain list does not mix with another tenant's domains. Domain conflicts, permission boundaries and visibility are kept within tenant boundaries.

Operation model suited for high connection counts

Virtual host groups are kept in separate workspaces for high connection counts. Multi-domain traffic is managed centrally without constraining connection capacity. Operational changes in one domain group do not unnecessarily affect other groups.

Zero-downtime updates with soft reload

When a domain, pool or certificate changes, TR7 detects the configuration difference. Only the affected component is refreshed via soft reload. Existing connections are drained while new traffic is accepted under the updated configuration.

Undefined domain behavior is controllable

Undefined Host or SNI values can be directed to a default backend, an error response or a security policy. This provides controlled behavior in subdomain hijacking and unexpected domain access scenarios.

Operational depth

The Virtual Hosts capability addresses not only domain matching but also reload strategy, tenant separation, wildcard normalization and high-connection operation together.

01

Group logic

Virtual hosts sharing the same IP, port and operating type are treated as a group. Domain mappings inside the group are generated in a sorted, deterministic order. This structure prevents spurious configuration diffs.

02

Matcher generation

Exact domain values are handled with direct string matching; wildcard domains are handled with automatic pattern matching. Because operators do not write regex manually, the risk of errors is reduced. Domain characters are safely escaped.

03

SNI / Host separation

In TLS mode the decision is made on the SNI value; in HTTP mode on the Host header. This separation is automatic. Operators do not need to write different routing logic for each scenario.

04

Configuration diff analysis

TR7 compares the current configuration with the configuration that should be generated. A reload or restart decision is made only if a real difference exists. If nothing has changed, no action is taken.

05

Soft reload behavior

A soft reload is applied only when the running proxy configuration has changed. This prevents unnecessary interruption of active connections. If a deeper workspace change is required, a controlled restart is performed.

06

Tenant visibility

Each zone sees its own domain and vhost configuration. Domain management is separated in multi-customer or multi-department deployments. This approach improves both operational security and management simplicity.

07

Pool dependency

Virtual host routing is meaningful only when the relevant pool is active and healthy. Pool health checks, backend status, certificates and the WAAP profile determine the final decision chain for domain traffic.

08

HTTP/2 and misdirected-request behavior

In modern clients, a mismatch between SNI and the Host header can cause traffic to reach the wrong backend. TR7 makes such situations controllable through the virtual host and security profile chain.

When to use it

Multi-tenant SaaS subdomain management

`tenant1.app.com`, `tenant2.app.com` and `tenant3.app.com` all share the same VIP. A wildcard domain rule captures all tenant subdomains under a single entry; each tenant is routed to its own pool and WAAP profile.

Separating e-commerce and admin panel on the same IP

`shop.example.com` goes to the public store pool; `admin.example.com` goes to a management pool with mTLS and stricter access policy. A single port 443 is used and security policies are separated at the domain level.

Splitting API versions with domains

`api.example.com` is routed to the new API pool while `api-v2.example.com` goes to the legacy pool. During the transition both services share the same IP; DNS and firewall architecture remain unchanged.

Working with a geographic policy chain

The virtual host layer separates the domain; the downstream pool layer applies different traffic rules or security profiles based on geographic information. A domain-and-location decision chain operates end-to-end.

Reducing subdomain hijacking risk

Undefined or unexpected subdomain requests are placed under a default security behavior. Even when a wildcard certificate is in use, uncontrolled backends cannot be reached by unexpected subdomains.

Public portal and private API on a single VIP

`portal.example.com` is open to internet users while `partner-api.example.com` is accessible only with mTLS and an IP allowlist. Both services share the same IP and port, each under its own security layer.

Frequently asked questions

What is the difference between SNI-based and Host header-based routing?
SNI routing takes place in the early stage of the TLS handshake — domain separation happens before the HTTP Host header is visible. This is especially useful in TLS passthrough scenarios. Host header routing comes into play for HTTP traffic after TLS termination. TR7 manages both modes automatically under the same virtual host model.
How are wildcard domains handled?
`*.example.com` wildcard entries are automatically converted by TR7 into safe matching patterns. Operators do not need to write regex by hand. A single wildcard definition routes unlimited subdomains to the correct pool, and domain characters are safely escaped throughout.
How many domains can run on the same VIP?
TR7's virtual host model does not impose a direct limit on the number of domains sharing an IP and port. Virtual host groups are kept in separate workspaces with a 500K nofile ulimit per container to sustain high connection counts. Changes in one domain group do not affect other groups.
Are connections dropped when a domain is changed?
No. TR7 analyzes the configuration diff and applies a soft reload only when a real change is detected. During the soft reload, existing connections are drained while new traffic is accepted under the updated configuration. Because the same input always produces the same output, unnecessary reloads are never triggered.
Can a separate WAAP or cache profile be used per domain?
Yes. A virtual host is not just a routing decision — it is a policy boundary. Because each domain is bound to its own pool, the WAAP profile, cache policy and log format can differ per domain. One domain can be protected by a strict WAAP profile while another is accelerated with a cache profile.
What happens when a request arrives for an undefined domain?
Undefined Host or SNI values can be directed to a default backend, a configured error response or a security policy. This behavior creates a controlled security layer for subdomain hijacking and unexpected domain access scenarios.

Manage all your domains over a single VIP

SNI and Host header separation, wildcard domain support, per-domain WAAP and zero-downtime reload. Let us walk you through a live setup on your own infrastructure.