# Acls for Tcp level requests

**URL:** <https://discourse.haproxy.org/t/acls-for-tcp-level-requests/2441>\
**Category:** Help!\
**Created:** [May 2, 2018, 11:31am UTC](https://discourse.haproxy.org/t/acls-for-tcp-level-requests/2441 "2018-05-02T11:31:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shankar](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@Shankar](https://discourse.haproxy.org/u/Shankar)\
**Post date:** [May 2, 2018, 11:31am UTC](https://discourse.haproxy.org/t/acls-for-tcp-level-requests/2441/1 "2018-05-02T11:31:00Z")

</div>

Hi ,

I had posted this question earlier but got no reply  
My requirement is to connect using jdbc to a server cluster. ( connection String :  
jdbc:teiid:OpenWorksCommonModel\_OpenworksDemo@mm://34.36.74.77:31000;version=5000106)

On haproxy machine all jdbc requests should listen on one port say 31000, but based on a substring in the connection string , haproxy should route the requests to different backend .

I have read the answer for a earlier question where it was mentioned that acl could be written with frontend on http and backend on tcp. This did not work . Please find below a list of configurations i tried . Adding a mode tcp to the backend gave me an error while restarting haproxy. My intend is to see if there exists a word “OpenWorks” in the jdbc connection string and if so route it to a specific backend.

**1st Configuration**

frontend TEIID\_PROXY  
bind \*:31000  
mode http

acl openworks\_teiid\_backend path\_sub OpenWorks  
use\_backend openworks\_backend1 if openworks\_teiid\_backend

backend openworks\_backend1  
**#mode tcp**  
balance source  
server db\_jdbc01 34.36.74.147:31000 check

**I also tried a random configuration**

listen DSIS\_JDBC :31001  
mode http

acl openworks\_teiid\_backend path\_sub OpenWorks  
use\_backend openworks\_backend if openworks\_teiid\_backend

backend openworks\_backend  
balance source  
server db\_jdbc01 34.36.74.147:31000 check

First configuration with mode tcp in the backend does not allow me to even start haproxy. Could you please help.

---

<div class="post-metadata">

**Author:** ![Shankar](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@Shankar](https://discourse.haproxy.org/u/Shankar)\
**Post date:** [May 3, 2018, 5:31am UTC](https://discourse.haproxy.org/t/acls-for-tcp-level-requests/2441/2 "2018-05-03T05:31:33Z")

</div>

Have tried to use http for front end and tcp for backendb as it was mentioned as a solution to some other question . I got the following error

frontend TEIID\_PROXY  
bind \*:31000  
mode http  
acl openworks\_teiid\_backend url\_sub OpenWorks  
use\_backend openworks\_backend1 if openworks\_teiid\_backend

backend openworks\_backend1  
mode tcp  
balance source  
server db\_jdbc01 34.36.74.147:31000 check

**Error :**

[ALERT] 121/074244 (2895) : Unable to use proxy ‘openworks\_backend1’ with wrong mode, required: http, has: tcp.  
[ALERT] 121/074244 (2895) : You may want to use ‘mode http’.  
[ALERT] 121/074244 (2895) : Proxy ‘TEIID\_PROXY’: unable to find required use\_backend: ‘openworks\_backend1’.  
[ALERT] 121/074244 (2895) : Fatal errors found in configuration.  
Errors in configuration file, check with haproxy check.  
[dsds@VC9LRD02RH66002 haproxy] sudo vi haproxy.cfg [dsds@VC9LRD02RH66002 haproxy] sudo service haproxy restart  
[ALERT] 121/235937 (20361) : Unable to use proxy ‘openworks\_backend1’ with wrong mode, required: http, has: tcp.  
[ALERT] 121/235937 (20361) : You may want to use ‘mode http’.  
[ALERT] 121/235937 (20361) : Proxy ‘TEIID\_PROXY’: unable to find required use\_backend: ‘openworks\_backend1’.  
[ALERT] 121/235937 (20361) : Fatal errors found in configuration.  
Errors in configuration file, check with haproxy check.

* * *

I have also tried the following configuration , but it doesnt work when i connect using jdbc . May be **url\_sub** is not available for tcp . If so what acl could we use to writing a condition for the the connection string

frontend TEIID\_PROXY  
bind \*:31000  
mode tcp  
acl openworks\_teiid\_backend **url\_sub** OpenWorks  
use\_backend openworks\_backend1 if openworks\_teiid\_backend

backend openworks\_backend1  
mode tcp  
balance source  
server db\_jdbc01 34.36.74.147:31000 check

---

<div class="post-metadata">

**Author:** ![ghp](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@ghp](https://discourse.haproxy.org/u/ghp)\
**Post date:** [May 4, 2018, 12:01pm UTC](https://discourse.haproxy.org/t/acls-for-tcp-level-requests/2441/3 "2018-05-04T12:01:04Z")

</div>

With “mode tcp” I would use req.payload for an ACL.