In my opinion, the DrayTek is the wrong place to be doing this. The DrayTek should pass all 443 traffic to a single internal IP. That IP should then do the header inspection.