Opennig ports behind gcnat with something like socat/frp/ngrok(?)

I was wondering if there is an option to create a tcp tunnel directly to haproxy, wich can serve as a backend?

Sort of what ngrok is doing.

No, there is not.

Something ingenious with some plugin or lua scripting is not possible?

Everything is possible. I’m not aware of a specific solution.

Had to resolve it with something like this

An experimental feature is in 2.9-dev4 called “reverse HTTP”:

https://www.mail-archive.com/haproxy@formilux.org/msg43924.html

Again that is a experimental feature in a development branch of haproxy, so this is a long way from being production ready. It’s a first step.