The DNS servers would tell the browser to use some specific **IP address**. That would be the public IP address used by your server, that you configured in the DNS servers.

<img src="/img/deployment/https/https01.svg">

### TLS Handshake Start

The browser would then communicate with that IP address on **port 443** (the HTTPS port).

	addrs, err := net.InterfaceAddrs()
	if err != nil {
		t.Fatalf("%s.  Unable to get IP addresses of this host.", err)
	}

	for _, addr := range addrs {
		var ip net.IP
		switch v := addr.(type) {
		case *net.IPNet:
			ip = v.IP
		case *net.IPAddr:
			ip = v.IP
		}

		if ip.To4() != nil {
			localIP4.Add(ip.String())
		}
	}

	// Filter ipList by IPs those do not start with '127.'.

	return args.Error(0)
}

func (m *MockedIpsetDeps) addIP(name string, ip netip.Addr, ipProto uint8, comment string, replace bool) error {
	args := m.Called(name, ip, ipProto, comment, replace)
	return args.Error(0)
}

func (m *MockedIpsetDeps) deleteIP(name string, ip netip.Addr, ipProto uint8) error {
	args := m.Called(name, ip, ipProto)
	return args.Error(0)
}

func (m *MockedIpsetDeps) flush(name string) error {

///

### DNS

Теперь давайте сфокусируемся на работе с HTTPS.

Всё начинается с того, что браузер спрашивает у **DNS-серверов**, какой **IP-адрес связан с доменом**, для примера возьмём домен `someapp.example.com`.

    /**
     * Retrieve all addresses of a host by it's address. NetBIOS hosts can
     * have many names for a given IP address. The name and IP address make the
     * NetBIOS address. This provides a way to retrieve the other names for a
     * host with the same IP address.
     *
     * @param addr
     *            the address to query
     * @return resolved addresses
     * @throws UnknownHostException

 * 
 * 1) IP Address - If a dot-quad IP string is used with getByName (or used
 * to create an NbtAddress internal to this netbios package), no query is
 * sent on the wire and the only state this object has is it's IP address
 * (but that's enough to connect to a host using *SMBSERVER for CallingName).
 * 
 * 2) IP Address, NetBIOS name, nodeType, groupName - If however a

	for _, s := range d.Services {
		var ip string
		if len(s.Addresses) != 0 {
			_, ip, _ = strings.Cut(s.Addresses[0], "/")
		}
		if ip == "" {
			// fallback to None when a service does not have a VIP
			ip = "None"
		}
		serviceNames[ip] = s.Hostname
	}
	for _, s := range d.Workloads {
		var ip string
		if len(s.WorkloadIPs) != 0 {
			ip = s.WorkloadIPs[0]
		}
		if ip == "" {

            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;

            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;

            proxy_connect_timeout 300;
            

            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;

            # This is necessary to pass the correct IP to be hashed
            real_ip_header X-Real-IP;

            proxy_connect_timeout 300;
            

      InetAddress ip = InetAddresses.forString(validIsatapAddress);
      assertTrue(InetAddresses.isIsatapAddress((Inet6Address) ip));
      assertEquals(
          "checking '" + validIsatapAddress + "'",
          ipv4,
          InetAddresses.getIsatapIPv4Address((Inet6Address) ip));
    }
    for (String nonIsatapAddress : nonIsatapAddresses) {
      InetAddress ip = InetAddresses.forString(nonIsatapAddress);