Your own host names on a dedicated IP

When to use your own names

• The partner calls an HTTPS or other TLS service by your own host name and expects port 443.
• Several of your host names share one dedicated IP. Each name is its own route on 443.
• A name under the tunnel zone needs none of this. Every tunnel route gets one, on shared IPs.
• Plain TCP, or TLS on another port, uses a TCP route on a port from 20000 to 29999 instead.
• It needs the dedicated inbound IP add-on, on Pro and up at $9 per IP-month.

Create the route

Create a tls route on the dedicated IP and name the host name the partner will send with --sni. A name may start with *. to match one label below a domain, such as *.example.com. Names under fixedmark.net are refused with route.sni_reserved. A route with an SNI pattern gets no name under the tunnel zone.

fm routes create --app APP_ID --kind tls --name partners \
  --dedicated-ip IP_ID --sni partners.example.com \
  --origin origin.example.com:443 \
  --partner 198.51.100.0/24

curl -X POST "https://api.fixedmark.com/v1/apps/APP_ID/routes" \
  -H "Authorization: Bearer $FIXEDMARK_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"kind":"tls","name":"partners","placement":{"mode":"dedicated","ip_id":"IP_ID"},"sni_pattern":"partners.example.com","origin":{"kind":"host","host":"origin.example.com","port":443},"partner_cidrs":["198.51.100.0/24"]}'

Wait for the job and the active state as for a TCP route. A connector origin works too: pass --connector and --to in place of --origin.

Point the name at your IP

Add an A record for the name with the IP's address as its value. Keep any other records for the name, and remove other A or AAAA records so every partner lookup reaches 203.0.113.10.

partners.example.com.   300   IN   A   203.0.113.10

dig +short partners.example.com A

The answer is 203.0.113.10 once the record has spread.

Certificates and TLS

• Your origin holds the certificate for partners.example.com, as it would without Fixedmark. The node never sees a key or a decrypted byte.
• The partner's TLS session runs end to end with your origin, so client certificates, ALPN, and TLS versions work as the origin configures them.
• A ClientHello with no server name, or a name no route on the IP matches, is closed without reaching any origin. The log row reads no_route.

Test from a partner address

curl -sv https://partners.example.com/ -o /dev/null
openssl s_client -connect 203.0.113.10:443 -servername partners.example.com </dev/null

The certificate printed is your origin's. Run the test from a source the route admits; any other source is dropped before the handshake.

What the origin sees

• The connection to your origin comes from your Fixedmark IP, not from the partner. Allowlist that one address on the origin.
• The partner's address is in the connection log row as peer. Fixedmark adds no header and no PROXY protocol line, since it does not change the partner's bytes.
• The origin receives the partner's ClientHello first, unchanged, then the rest of the session.