# Convert proxy connect request

**URL:** <https://discourse.haproxy.org/t/convert-proxy-connect-request/2103>\
**Category:** Help!\
**Created:** [February 9, 2018, 12:08pm UTC](https://discourse.haproxy.org/t/convert-proxy-connect-request/2103 "2018-02-09T12:08:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![proxyuser](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@proxyuser](https://discourse.haproxy.org/u/proxyuser)\
**Post date:** [February 9, 2018, 12:08pm UTC](https://discourse.haproxy.org/t/convert-proxy-connect-request/2103/1 "2018-02-09T12:08:41Z")

</div>

Hi,

I am currently using some squid forwarding proxies to provide internet access to a number of desktops in a locked down vlan.

A new application is being deployed that will send a lot of requests to an external api.  
My squid proxies are currently configured to perform user authentication.  
What I would like to do is to intercept requests from certain ip’s going to certain urls and send them directly to the endpoint, bypassing the squid proxies.

simliar to:  
frontend proxyin  
bind \*:8081  
mode http  
use\_backend apihttp if { base\_dom -i [example.com](http://example.com) }

default\_backend proxyout

backend proxyout  
mode http  
server proxyout1 XX.XX.XX.XX:3128 maxconn 100 weight 10 check

backend apihttp  
mode http  
server apiserver1 XX.XX.XX.XX:443 check ssl verify none

The problem is that as the platforms are setup to talk via Proxy, the requests going to the api server are CONNECT requests that the oldish api platform doesn’t understand.

Is there any way to get HAProxy to replicate proxy functionality for these requests?

Thanks

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 12, 2018, 8:53pm UTC](https://discourse.haproxy.org/t/convert-proxy-connect-request/2103/2 "2018-02-12T20:53:48Z")

</div>

Mmmmh, there is only a **very limited** functionality that goes in this direction, its called [option http\_proxy](https://cbonte.github.io/haproxy-dconv/1.7/configuration.html#4.2-option%20http_proxy).

I suggest you don’t go down that road. Better add an additional real forward proxy in the mix and route to that one when haproxy detects the call goes to the external API.

---

<div class="post-metadata">

**Author:** ![proxyuser](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@proxyuser](https://discourse.haproxy.org/u/proxyuser)\
**Post date:** [February 13, 2018, 11:34am UTC](https://discourse.haproxy.org/t/convert-proxy-connect-request/2103/3 "2018-02-13T11:34:42Z")

</div>

Hi @lukastribus

Yeah thats exactly what i’m doing.

so for some traffic it is:  
client --\> haproxy --\> squid --\> endpoint

other, api based traffic is:  
client --\> haproxy --\> endpoint

The problem is that for traffic that doesn’t go to the forward proxy, when ha proxy sends it direct to the api endpoint, its sending the full CONNECT initialization to the endpoint. (Outbound traffic is configured via proxy)  
My original idea was to allow haproxy to perform first touch operations on the outbound requests so that I could having to send all the traffic to the forwarding proxies. Known endpoints from whitelisted ip addresses could bypass the forwarding proxy.  
I don’t think that this is going to be possible however. I’ll probably take the haproxy out and just send all traffic to the forwarding proxy.