I have Haproxy 1.5.18
On one IP address and one port I receive traffic from some https (www.page1.com, www.page2.com…) in Haproxy.
Some page need mutual SSL autentication but not all.
It’s posible (based on Host - www.page1.com, www.page2.com…) split this traffic on multiple frontend with different bind (some with mutual SSL autentication and some without) ?
I created a config:
frontend one_ip_port
mode tcp
acl page1 hdr(Host) www.page1.com
acl page2 hdr(Host) www.page2.com
bind 172.16.1.1:4431
use_backend bk_page1 if page1
use_backend bk_page2 if page2
backend bk_page1
mode tcp
server page1 172.16.1.1:4432 check
backend bk_page2
mode tcp
server page2 172.16.1.1:4433 check
frontend page1
mode http
bind 172.16.1.1:4432 ssl crt /etc/pki/tls/certs/cert.pem ca-file /etc/pki/tls/certs/ca_cert.cer verify required
default_backend bk_page1
backend bk_page1
mode http
server s1 192.168.10.101:80 check
server s2 192.168.10.102:80 check
frontend page2
mode http
bind 172.16.1.1:4433 ssl crt /etc/pki/tls/certs/cert.pem
default_backend bk_page2
backend bk_page2
mode http
server s3 192.168.10.103:80 check
server s4 192.168.10.104:80 check
But haproxy reports error for mode tcp:
[WARNING] 216/144953 (32701) : config : ‘option forwardfor’ ignored for frontend as it requires HTTP mode.
[WARNING] 216/144953 (32701) : config : ‘option forwardfor’ ignored for backend as it requires HTTP mode.
And not forwarding traffic.
Browser reports “This site is unreachable The server ended the connection unexpectedly.”
Haproxy log have several records:
Aug 5 19:27:54 localhost haproxy[29280]: Connect from 10.16.1.101:64228 to 172.16.1.1:4431(one_ip_port/TCP)
Someone has an idea ?
Thanks in advance,
Mariusz