# HAproxy route to default backend, when req.hdr(host) is not in map file

**URL:** <https://discourse.haproxy.org/t/haproxy-route-to-default-backend-when-req-hdr-host-is-not-in-map-file/6031>\
**Category:** Help!\
**Created:** [December 16, 2020, 12:30pm UTC](https://discourse.haproxy.org/t/haproxy-route-to-default-backend-when-req-hdr-host-is-not-in-map-file/6031 "2020-12-16T12:30:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dr-ing](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@dr-ing](https://discourse.haproxy.org/u/dr-ing)\
**Post date:** [December 16, 2020, 12:30pm UTC](https://discourse.haproxy.org/t/haproxy-route-to-default-backend-when-req-hdr-host-is-not-in-map-file/6031/1 "2020-12-16T12:30:43Z")

</div>

Hello,

I have configured my HAproxy CE 1.8.19-1+deb10u3 with two backends. To decide which host (req.hdr(host)) belongs to which backend, I use maps, because I can configure them quite easily via REST with Dataplane. But, before I started using haproxy, I already had a lot of vhosts (= subdomains) and if I don’t have to do it, I don’t want to write them all to the map file, just the new ones. Which shouldn’t be a problem, because all my already existing vhosts were configured on one server (= backend), and all new vhosts will be configured either on the same server ( = then don’t create a new map entry) or on the new server ( = then create a new map entry).

So my HAproxy has to look if the called domain (e.g. [abc.example.com](http://abc.example.com)) is in the map file. If it is, then the backend from the map value should be used. If the host is not in the map file, then a hardcoded backend should be used.

An important point is that when using SSL, the HAproxy should not do an SSL termination (so instead a SSL pass-through) !

Right now I have following configuration (snippet) :

> ```
> frontend http_in 
> mode http
> bind *:80
> option forwardfor
> option httplog
> use_backend %[req.hdr(host),lower,map_str(/etc/haproxy/maps/my_backends.map,http-hardcoded_backend)]
> 
> # HTTPS Frontend
> frontend https_in 
> mode tcp
> bind *:443
> option tcplog
> tcp-request inspect-delay 5s
> use_backend %[req.hdr(host),lower,map_str(/etc/haproxy/maps/my_backends.map,https-hardcoded_backend)]
> 
> # == BACKEND - SECTION ==
> #
> # hardcoded_backend = my old server
> backend http-hardcoded_backend
> mode http
> option forwardfor
> server OLDSERVER 10.0.150.22:80
> 
> backend https-hardcoded_backend
> mode tcp
> option ssl-hello-chk
> server OLDSERVER 10.0.150.22:443
> 
> # http(s) backend from map value
> backend http-mapvalue
> mode http
> option forwardfor
> server MAPVALUE 10.0.150.20:80
> 
> backend https-mapvalue
> mode tcp
> option ssl-hello-chk
> server MAPVALUE 10.0.150.20:443
> 
> ```

For HTTP, this works (so when I visit a host, which is inside the host file, I get to the “http-mapvalue” backend. When the host is not in the host file, I get to the “http-hardcoded\_backend” ), but over HTTPS I get following error message (with cURL):  
`curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to abc.my.domain:443`  
one both backends.

**EDIT:**  
By adding `tcp-request content accept if { req_ssl_hello_type 1 }` I get at least requests and therefore logs on my HAproxy. I guess this works now but for some reason, the haproxy doesnt detect the right backend?

`[16/Dec/2020:16:09:09.461] https_in https_in/<NOSRV> -1/-1/14 0 SC 1/1/0/0/0 0/0`

On HTTP everything works (still) fine, but on HTTPS, which has the same use\_backend line it doesn’t.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [December 16, 2020, 3:57pm UTC](https://discourse.haproxy.org/t/haproxy-route-to-default-backend-when-req-hdr-host-is-not-in-map-file/6031/2 "2020-12-16T15:57:25Z")

</div>

HTTPS is encrypted, meaning you cannot access the HTTP header.

_IF_ your SSL certificates do not have any overlaps, then you can use SNI instead.

> **[HAProxy version 2.2.5 - Configuration Manual](https://cbonte.github.io/haproxy-dconv/2.2/configuration.html#7.3.5-req.ssl_sni)**

```
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
use_backend %[req_ssl_sni,lower,map_str(/etc/haproxy/maps/my_backends.map,https-hardcoded_backend)]
```