Redirecting using TCP and req_ssl_sni

Help!
1

Hi,

I’m trying to perform a redirect to a CloudPanel backend if my req_ssl_sni is equal to a particular domain, however unfortunately this doesn’t seem to be doing anything and still redirecting to my kubernetes_https backend. Am I doing something wrong? I’ve tried asking AI but it’s a little limited!

defaults
log	global
mode	tcp
option	tcplog
option	dontlognull

frontend https
mode tcp
bind :443,[::]:443 transparent

tcp-request inspect-delay 5s

# redirect to our cloudpanel server
acl cloudpanel_req req_ssl_sni -i subdomain.example.com
acl cloudpanel_req_2 req_ssl_sni -i subdomain2.example.com
use_backend cloudpanel_https if cloudpanel_req
use_backend cloudpanel_https if cloudpanel_req_2

# by default, redirect to kubernetes
default_backend kubernetes_https

# Kubernetes HTTPS backend
backend kubernetes_https

default-server inter 2s downinter 5s rise 2 fall 2 slowstart 60s maxconn 250 maxqueue 256 weight 100
option ssl-hello-chk

server master1 192.168.1.71:443 check send-proxy-v2
server master2 192.168.1.72:443 check send-proxy-v2
server master3 192.168.1.73:443 check send-proxy-v2
server worker1 192.168.1.74:443 check send-proxy-v2
server worker2 192.168.1.75:443 check send-proxy-v2

# CloudPanel HTTPS backend
backend cloudpanel_https

default-server inter 10s downinter 5s rise 2 fall 2 slowstart 60s maxconn 250 maxqueue 256 weight 100
option ssl-hello-chk

server cloudpanel 192.168.1.140:443 check

From everything I’ve read, checking the config validity and a little sanity check with AI, the above should work. Am I missing something?

Thanks,
Chris.

2

You are missing a:

tcp-request content accept if { req.ssl_hello_type 1 }

in that frontend, to avoid blocking the request for 5 seconds.

use_backend cloudpanel_https if acl cloudpanel_req_2

remove acl here.

3

Thank you, that’s great!

In conjunction with the inspect delay that’s working brilliantly :slight_smile:

Appreciate the help!