# Mixing mode tcp and http - SSL termination and Passthrough

**URL:** https://discourse.haproxy.org/t/mixing-mode-tcp-and-http-ssl-termination-and-passthrough/2698
**Category:** Help!
**Created:** [July 6, 2018, 4:56pm UTC](https://discourse.haproxy.org/t/mixing-mode-tcp-and-http-ssl-termination-and-passthrough/2698 "2018-07-06T16:56:42Z")
**Posts on this page:** 1
**Showing post:** 16

<div class="post-metadata">

### Author: ![oezh](https://avatars.discourse-cdn.com/v4/letter/o/90db22/32.png) [@oezh](https://discourse.haproxy.org/u/oezh)
#### Post date: [January 12, 2020, 7:29pm UTC](https://discourse.haproxy.org/t/mixing-mode-tcp-and-http-ssl-termination-and-passthrough/2698/16 "2020-01-12T19:29:46Z")

</div>

Old post, but I think I solve that same problem, it was driving me crazy. The solution is to CONCATENATE a backend with a frontend, like this:

#######haproxy.cfg\_BEGIN##################  
…  
…  
frontend SSL\_PassThrough  
mode tcp  
bind \*:80  
bind \*:443  
tcp-request inspect-delay 5s  
tcp-request content accept if { req\_ssl\_hello\_type 1 }

```
use_backend backend1 if { req_ssl_sni -i aaa.bbb.com }
use_backend backend2 if { req_ssl_sni -i ccc.ddd.com }
use_backend bbackend3 if { req_ssl_sni -i eee.fff.com }
default_backend bk_tcp_to_https

```

backend bk\_tcp\_to\_https  
mode tcp  
server haproxy-https 127.0.0.1:8443 check

frontend SSL\_Termination  
mode http  
bind \*:8443 ssl crt /etc/haproxy/certs/ggg.hhh.com.pem crt /etc/haproxy/certs/iii.kkk.com.pem

```
use_backend backend4 if { hdr(host) -i ggg.hhh.com }
use_backend backend5 if { hdr(host) -i iii.kkk.com }

```

#SSL Passthrough Backends (every backend manage their own SSL termiantion)  
backend backend1  
mode tcp  
server server1 192.168.0.100:443 check

backend backend2  
mode tcp  
server server2 192.168.0.101:443 check

backend backend3  
mode tcp  
server server3 192.168.0.102:443 check

#SSL Terminated by HAProxy Backends (plain http traffic between HAProxy and these backends)  
backend backend4  
mode http  
server server4 192.168.0.104:80 check  
http-request set-header X-Forwarded-Port %[dst\_port]  
http-request add-header X-Forwarded-Proto https if { ssl\_fc }

backend backend5  
mode http  
server server5 192.168.0.105:80 check  
http-request set-header X-Forwarded-Port %[dst\_port]  
http-request add-header X-Forwarded-Proto https if { ssl\_fc }  
#########haproxy.cfg\_END#################

The Trick here is “default\_backend bk\_tcp\_to\_https” in frontend1 that concatenates all the requests that are not going to be passthrough, to the “backend bk\_tcp\_to\_https”.  
It is basically telling if the request is not for [aaa.bbb.com](http://aaa.bbb.com) or [ccc.ddd.com](http://ccc.ddd.com) or [eee.fff.com](http://eee.fff.com), then send it to the default backend, which is himself: 127.0.0.1 but in other port: 8443, and then, Frontend2 is listening in 8443 to take care of the termination of the SSL.

This is the mixed TCP/HTTP combination to passthrough some SSL and terminate others using one single configuration.

---

_[View the full topic](https://discourse.haproxy.org/t/mixing-mode-tcp-and-http-ssl-termination-and-passthrough/2698)._