Match against req.ssl_sni AND dst_port

[f1outsourcing]

use_backend _recir_test if { req.ssl_sni -i test.example.com } { dst_port 443 }
use_backend _recir_test1 if { req.ssl_sni -i test.example.com } { dst_port 8443 }

Why is this not working? It looks like the AND condition on the port is matched against something that does not exist, and I am redirected to some later configured 443 backend.
If I remove the { dst_port 443 }, I am getting the correct backend, but of course never the test1

It has been asked before, but not really answered.

SSL Termination: Multiple Domains Sharing Same IP and Port

This configuration does not make sense to me, let’s clarify what your goals are first. You do not appear to have any domains where you need to pass through SSL transparently, without SSL termination. All the SSL termination should happen on haproxy, correct? There are no (real) backends that expect traffic on port 443? Why all those duplicates backends? Unless your requirements are way more complicated, just configure both certificates on the bind line: frontend fe1 bind *:80 bind *:44…

2.2.25-50b5f5d

[lukastribus]

Some clients may add port numbers to the SNI value.

So https://test.example.com:8443/index.html could have a SNI value of test.example.com:8443 instead of test.example.com.

I suggest you check what SNI value your test client is actually sending.

[f1outsourcing]

I seem to have some results (and errors in multiple sections), can it be that such redirects are not updated when reloading? After I changed gw to gtw. I seem to have better results.

    177 backend _recir_gtw
    178   server loopback-for-tls abns@gtw

Next to this I also have still some acl that is blocking, while I am definitely having the correct ip configured.

    296   acl net_office src x.x.x.x
    297   #http-request silent-drop if !net_office
    298   http-request deny if !net_office

I should be able to create as many net_office acl’s as I like not?

[lukastribus]

@f1outsourcing

I seem to have some results (and errors in multiple sections), can it be that such redirects are not updated when reloading? After I changed gw to gtw. I seem to have better results.

A reload means that the old process is not killed. If the old process continues the serve requests there may be unwanted interaction between the old and the new process. Abstract namespace sockets although very convenient is not very widely used, so there maybe caveats.

@f1outsourcing

I should be able to create as many net_office acl’s as I like not?

Yes.

[f1outsourcing]

It looks like that when I add to “server loopback-for-tls” the “send-proxy-v2” it starts to work. I think this backend I am using is not supporting the protocol so I thought I could leave it out.