# How to redirect traffic on port 8443

**URL:** <https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220>\
**Category:** Help!\
**Created:** [April 15, 2016, 3:21pm UTC](https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220 "2016-04-15T15:21:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![fbyrne](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@fbyrne](https://discourse.haproxy.org/u/fbyrne)\
**Post date:** [April 15, 2016, 3:21pm UTC](https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220/1 "2016-04-15T15:21:37Z")

</div>

Hi,  
I have a config section like below. It works fine for a single backend using port 8443.

I now need to have multiple backends behind this one frontend - can someone help me out? I tried the ‘use\_backend’ line to have multiple backends - see below - but it didn’t work.

Also, how would I implement SSL on these backends?

Thanks.

> frontend ft\_myservice  
> bind 10.x.xx.xx:8443 name HTTPS  
> mode tcp  
> log global  
> capture request header host len 64  
> capture request header user-agent len 64  
> capture response header location len 64  
> maxconn 1000  
> #use\_backend bk\_%[req.hdr(host),lower]  
> default\_backend bk\_myservice.mydomain.ie

> backend bk\_myservice.mydomain.ie  
> balance roundrobin  
> mode tcp  
> log global  
> fullconn 1000 # dynamic limiting below  
> option httpchk GET /myservice HTTP/1.0\r\nHost:\ myservice.mydomain.ie  
> http-check expect string diveport  
> default-server slowstart 0 inter 10s rise 2 fall 3 # servers default parameters  
> server MyBigServer 10.x.xx.xx:8443 weight 10 maxconn 1000 check check-ssl

---

<div class="post-metadata">

**Author:** ![fbyrne](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@fbyrne](https://discourse.haproxy.org/u/fbyrne)\
**Post date:** [April 19, 2016, 2:45pm UTC](https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220/2 "2016-04-19T14:45:05Z")

</div>

Can anyone help on this please?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 19, 2016, 3:01pm UTC](https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220/3 "2016-04-19T15:01:26Z")

</div>

You will have to ask yourself first how haproxy is supposed to pick on backend over the other. Based on a header, maybe SNI or Host? What is it that you want to achieve exactly?

You probably have to switch to http mode. If you really need ssl on the backend side (you do seem to be on a LAN, so I’m not sure if that makes sense), specify the ssl keyword on the server line.

---

<div class="post-metadata">

**Author:** ![Baptiste](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@Baptiste](https://discourse.haproxy.org/u/Baptiste)\
**Post date:** [April 23, 2016, 9:53pm UTC](https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220/4 "2016-04-23T21:53:42Z")

</div>

Frank,  
From my understanding, you try to match HTTP content on a connection where traffic is ciphered… So it obviously can’t work.  
Lukas has provided useful pointers to you.

---

<div class="post-metadata">

**Author:** ![fbyrne](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@fbyrne](https://discourse.haproxy.org/u/fbyrne)\
**Post date:** [April 25, 2016, 10:07pm UTC](https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220/5 "2016-04-25T22:07:07Z")

</div>

Hi Lukas -

I tried to use this syntax to pick the backend but it didn’t work.

use\_backend bk\_%[req.hdr(host),lower]

I commented out in the example to show what currently is in place.

Can you provide an example of how you might implement this?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 25, 2016, 10:46pm UTC](https://discourse.haproxy.org/t/how-to-redirect-traffic-on-port-8443/220/6 "2016-04-25T22:46:13Z")

</div>

You cannot match a HTTP header, when the traffic passing through is encrypted (HTTPS), and you are not terminating SSL here.

[Terminate SSL](http://blog.haproxy.com/2013/02/26/ssl-offloading-impact-on-web-applications/) or [content switch based on SNI](http://blog.haproxy.com/2012/04/13/enhanced-ssl-load-balancing-with-server-name-indication-sni-tls-extension/).