I have an Azure environment with different VNETs for each environment (dev, test, and so on). Each VNET has its own Azure Application Gateway with WAF enabled (due to the limitation on number of sites/WAF). Each Gateway has a public IP with a fqdn, and a couple of CNAME entries in my own DNS, so that I can host multiple domains from the same Gateway (eg. test.contoso.com and test2.contoso.com all resolve to the same Gateway, and based on the originating domain I can forward to the correct backendpool which will serve the request).
However, I want to let all incoming (and outgoing) traffic go through an Azure Firewall (the hub) and forward to the correct Gateway. I know I need to peer all my spoke VNET's with the hub VNET, and probably convert the public IP of the Gateway to a private one, but it is not clear to me how I can forward the incoming traffic to the correct spoke. Is it possible to filter on the originating domain? Is that what DNAT is? And if so, Azure states that DNAT is not possible for port 80 (https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-dnat), would that mean it is not possible to use hub-spoke for http traffic on port 80?
Edit: I presumed the firewall would get an ip address and I needed to update my CNAME's to the firewall fqdn, but it seems that is not the case? Just having the firewall in the VNET would let all traffic go through the firewall? I tried it by putting a deny all rule on the firewall, but I can still access my website through the public ip of the Gateway that is in the same vnet as the firewall.