# How can I use a wildcard for my intercepts? **URL:** \ **Category:** Tunneler Apps\ **Created:** [March 14, 2022, 4:36pm UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317 "2022-03-14T16:36:42Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 14, 2022, 4:36pm UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317/1 "2022-03-14T16:36:42Z")
A question came in from email asking how the user might go about intercepting/tunneling ALL traffic that meets a domain. We call this “wildcard” dns. On the client side I wish to intercept “\*.blue” so anything that goes to this domain will get intercepted and then tunneled to the other end, where it will then get ofloaded from the ziti overlay back to the local network. For example on my client I want to intercept two addresses: `web-test.blue` and `web.test.blue`. How can I do something like this with OpenZiti ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/1X/4ea0bd4d7952e6c31c13a4cfe1ac7bdc5ab57ab9.png) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 14, 2022, 4:43pm UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317/2 "2022-03-14T16:43:46Z")
I ended up producing a video that demonstrates how to accomplish this. [You can find it on YouTube](https://youtu.be/1GC7gt3rsrg). [![](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/1X/a494e5c1f315390f5a44bea0a80fd87bb3057372.jpeg "Wildcard DNS with OpenZiti using Ziti Desktop Edge for Windows") ](https://www.youtube.com/watch?v=1GC7gt3rsrg) It uses the docker-compose based quickstart, the ziti-edge-tunnel for linux (attached to the ‘blue’ docker network) and the Ziti Desktop Edge for Windows. Give it a watch - it’s under 10 minutes! 🙂 The `ziti` CLI commands I run are all in the youtube video. A follow-up question came back because I used only two allowed addresses: `allowedAddresses":["web.test.blue", "web-test.blue"]` however you can absolutely change that to be `allowedAddresses":["*.blue"], ` (and I should have done that anyway). You’ll also see I went ham with the ports and exposed them all - I don’t recommend you do that but you might need/want to. If you have any questions on the video - this would be the best place to talk about it! 🙂 YouTube comments aren’t, that’s for sure! Another follow-up question was if a tunneler is NECESSARY on the ‘client’ side. My answer to that was NO. You can absolutely look at how a ‘tunneling app’ works and adopt all the same ideas/patterns/code as necessary to make your app **INTO** a tunneling app! This is super cool because we have a whole SDK dedicated to working ‘as a tunneller’! You can find it on github here [GitHub - openziti/ziti-tunnel-sdk-c](https://github.com/openziti/ziti-tunnel-sdk-c) ---
**Author:** ![Crystech](https://avatars.discourse-cdn.com/v4/letter/c/ac91a4/32.png) [@Crystech](https://openziti.discourse.group/u/Crystech)\ **Post date:** [November 1, 2023, 8:02am UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317/5 "2023-11-01T08:02:28Z")
i noticed [wildcard.domain.com](http://wildcard.domain.com) will work but not wildcard.domain.com.wildcard will not work ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [November 1, 2023, 1:12pm UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317/6 "2023-11-01T13:12:15Z")
I'm not entirely sure what you mean or what you did. If you post your `ziti` cli commands so I can see them, that's helpful. My guess is that you didn't set the "allowedAddresses" correctly maybe? ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [November 1, 2023, 1:19pm UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317/7 "2023-11-01T13:19:24Z")
The wildcard in a Ziti service intercept is for the "least significant label" in DNS terms. It's always on the left side, which is the lowest position in the DNS hierarchy. `*.example.com` is valid, `*.example.*` is not. ---
**Author:** ![Crystech](https://avatars.discourse-cdn.com/v4/letter/c/ac91a4/32.png) [@Crystech](https://openziti.discourse.group/u/Crystech)\ **Post date:** [November 1, 2023, 1:53pm UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317/8 "2023-11-01T13:53:58Z")
Yes , I was trying to intercept for some addresss with additional country tld . Example google.com.sg Adding regexp support might be useful ? ---
**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\ **Post date:** [November 1, 2023, 3:51pm UTC](https://openziti.discourse.group/t/how-can-i-use-a-wildcard-for-my-intercepts/317/9 "2023-11-01T15:51:34Z")
I realize this suggestion probably isn't ideal, but you can specify as many `addresses` as you like in the intercept configuration: ```bash ziti edge create config multinational-apps-intercept.v1 intercept.v1 '{ "protocols": "tcp", "addresses": ["*.example.ua", "*.example.us", "*.example.ca"], "portRanges": [{"low":443,"high":443}] }' ```