New to Sophos - Allow traffic to multiple docker containers sub domains

Hi all,

I'm looking for a bit of hand holding and guidance here.  What I am trying to do is allow access to internal containers hosting multiple websites and applications.  I have a fresh Sophos Setup with no special custom rules or anything yet.   I have a public IP set to my WAN port and I have a domain name that is proxied via CloudFlare.

What I want to figure out is how to go to do some of these use cases:

1.   going to domain.com will take me to a specific container hosting that web site using the docker created network
2.   going to nas.domain.com will take me to the admin interface of the NAS on which the docker containers are hosted
3.   going to subdomain.domain.com will take me to a whole other container running a different site using the docker created network

I am currently using an XGS107w.  I didn't know at the time that the free home use licenses are not valid if you buy hardware and are only for self hosted.

Port 1 is LAN - 10.0.0.1/24 network

Port 2 is WAN XXX.XXX.XXX.XXX (public IP)

Wi-Fi is configured and bridged to LAN network

Only rules so far are LAN to LAN and a LAN to WAN

I keep getting host errors from cloudflare when I think I have everything setup.  Again very new to this type work.  any help would be greatly appreciated.