# Shared Frontends - how to do SSL of loading and SNI forwarding

**URL:** <https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612>\
**Category:** Help!\
**Created:** [April 28, 2022, 3:01pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612 "2022-04-28T15:01:07Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [April 28, 2022, 3:01pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/1 "2022-04-28T15:01:07Z")

</div>

Hi,  
I’m using haproxy through PfSense and as I’m not able to have my conf working, I was wondering if what I need is possible or not, hence my question here.

here is a recap of my need :

I have 1 single public IP address,  
I need the following at the same time :

I have a domain , [smalldragoon.com](http://smalldragoon.com) , where

**A1** - [A.smalldragoon.com](http://A.smalldragoon.com), [B.smalldragoon.com](http://B.smalldragoon.com), [C.smalldragoon.com](http://C.smalldragoon.com) need to be forwarded to an internal which is managing the SSL connection ( equivalent to port forwarding of the 443 as ex )  
**A2** - [D.smalldragoon.com](http://D.smalldragoon.com) need to have its SSL communication terminated on PFSense and redirected to an internal host which is running on port 80 ( so not in https , it is a basic website).  
Ex : [https://D.smalldragoon.com](https://D.smalldragoon.com) redirect to [http://192.168.1.1:80](http://192.168.1.1:80)

So maybe first question : is this possible ?  
I get some warnings with telling me I need to use shared frontends but everything I have done so far did not work.  
Of course, each config alone works perflectly

Thanks for your insights !

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 2, 2022, 10:58am UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/2 "2022-05-02T10:58:46Z")

</div>

well…up ? just at least to know if iti is posisble or not ?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 2, 2022, 12:01pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/3 "2022-05-02T12:01:47Z")

</div>

It’s possible, you need a TCP frontend that SNI routes the traffic as necessary.

The SSL session that you want to terminate you router to SSL terminating frontend on another port of the same haproxy instance, so you are able to have both.

This all works only if the certificates do not overlap.

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 4, 2022, 4:11pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/4 "2022-05-04T16:11:37Z")

</div>

Hi @lukastribus , thanks for your answer.  
let me rephrase to be sure I understand correctly :  
I have 2 domain A and B  
I want to terminate B and fw A as is to internal  
So based on SNI, single frontend, I  
for A domain, FW to my internal host  
for B : redirect to port 12345  
then create another frontend on port 12345 , which will do SSL termination  
am I correct stating that ?  
Thanks

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 4, 2022, 5:24pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/5 "2022-05-04T17:24:22Z")

</div>

> [@smalldragoon](#):
>
> for B : redirect to port 12345  
> then create another frontend on port 12345 , which will do SSL termination

Exactly.

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 5, 2022, 7:22am UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/6 "2022-05-05T07:22:56Z")

</div>

Thanks a lot !  
I will play in the next couple of days !  
Thanks

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 8, 2022, 6:06pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/7 "2022-05-08T18:06:02Z")

</div>

Hi,  
As I still can’t get it working , I decided to proceed step by step.  
1 - re-started from a blank complete config.  
2 - created a front end with SNI on port 443, with each Server Name Indication TLS extension matches _[X1.smalldragoon.com](http://X1.smalldragoon.com)_ to an action ( X1 to x1, X2 to x2 …).  
Action beiing : x1 - \> use backend “general”; General is a backend with forward to ip + port and has his own certificate public working .  
3 - apply config , it works ( if I try to reach [X1.smalldragoon.com](http://X1.smalldragoon.com)" )  
4 - Now, I Change this frontend to use port 445  
5 - I create a backend " [Forwarder-to-smalldragoon.com](http://Forwarder-to-smalldragoon.com)", where action is " redirected to frontend “my main frontend which now listeing on port 445 )  
6 - create a new front end, using port 443, with a rule " Server Name Indication TLS extension contains: [smalldragoon.com](http://smalldragoon.com)”, forward to backend “[Forwarder-to-smalldragoon.com](http://Forwarder-to-smalldragoon.com) port 445”  
it just do not do anything …  
Am doing right ?missing a step or even maybe it is where I’m wrong since the begining … is it the proper method ?  
Thanks  
[EDIT] I forgot to say that of course, if I try to reach site on port 445 ( [https://X1.smalldragoon.com:445](https://X1.smalldragoon.com:445) , it works )

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 9, 2022, 7:37am UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/8 "2022-05-09T07:37:36Z")

</div>

Post the full configuration, otherwise it’s difficult to get a complete picture of the situation.

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 9, 2022, 8:40am UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/9 "2022-05-09T08:40:15Z")

</div>

sure, here we go then

```auto

global
        maxconn 1500
        log /var/run/log local0 debug
        stats socket /tmp/haproxy.socket level admin expose-fd listeners
        uid 80
        gid 80
        nbproc 1
        nbthread 1
        hard-stop-after 15m
        chroot /tmp/haproxy_chroot
        daemon
        tune.ssl.default-dh-param 2048
        log-send-hostname BASTION
        server-state-file /tmp/haproxy_server_state

listen HAProxyLocalStats
        bind 127.0.0.1:2200 name localstats
        mode http
        stats enable
        stats refresh 10
        stats admin if TRUE
        stats show-legends
        stats uri /haproxy/haproxy_stats.php?haproxystats=1
        timeout client 5000
        timeout connect 5000
        timeout server 5000

frontend Main-Frontend-SNI-redirect-443
        bind [MY PUBLIC IP]:443 name [MY PUBLIC IP]:443
        mode tcp
        log global
        timeout client 30000
        tcp-request inspect-delay 5s
        acl dragoon req.ssl_sni -m sub -i smalldragoon.com
        tcp-request content accept if { req.ssl_hello_type 1 }
        use_backend Forwarder-to-smalldragoon.com-port-445_ipvANY if dragoon

frontend Frontend-smalldragoon.com-SNI
        bind [MY PUBLIC IP]:445 name [MY PUBLIC IP]:445
        bind /tmp/haproxy_chroot/Frontend-smalldragoon.com-SNI.socket name unixsocket uid 80 accept-proxy
        mode tcp
        log global
        timeout client 30000
        tcp-request inspect-delay 5s
        acl admin req.ssl_sni -i admin-poc.smalldragoon.com
         acl ssp req.ssl_sni -i ssp-poc.smalldragoon.com
        acl dmz req.ssl_sni -i dmz-poc.smalldragoon.com
        tcp-request content accept if { req.ssl_hello_type 1 }
        use_backend smalldragoon.com-Server_ipvANY if admin
        use_backend smalldragoon.com-Server_ipvANY if ssp
        use_backend smalldragoon.com-Server_ipvANY if dmz
		
		
backend Forwarder-to-smalldragoon.com-port-445_ipvANY
        mode tcp
        id 106
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        option httpchk OPTIONS /
        server forwarder /Frontend-smalldragoon.com-SNI.socket send-proxy-v2-ssl-cn id 107 check inter 1000

backend smalldragoon.com-Server_ipvANY
        mode tcp
        id 104
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        server smalldragoon.com 192.168.1.1:443 id 105 check inter 1000

```

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 9, 2022, 10:05pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/10 "2022-05-09T22:05:03Z")

</div>

A few suggestions:

- you only need to match SNI in _one_ frontend (the one listening on port 443)
- start using normal IP sockets for the backend → frontend re-circulation, thats less complex
- don’t start adding features when your basic configuration doesn’t work. Don’t use proxy-protocol on the first try
- I don’t see _any_ SSL terminating configuration in there, so it’s unclear how that would work

Here’s a (untested) configuration that would work, based on your initial description (a, b, [c.smalldragoon.com](http://c.smalldragoon.com) should be SSL passthrough, [d.smalldragoon.com](http://d.smalldragoon.com) should be SSL terminated):

```
frontend Main-Frontend-SNI-redirect-443
        bind [MY PUBLIC IP]:443 name [MY PUBLIC IP]:443
        mode tcp
        log global
        timeout client 30000
        tcp-request inspect-delay 5s
        tcp-request content accept if { req.ssl_hello_type 1 }
        
        acl passthroughdom req.ssl_sni -i a.smalldragoon.com
        acl passthroughdom req.ssl_sni -i b.smalldragoon.com
        acl passthroughdom req.ssl_sni -i c.smalldragoon.com
        use_backend passthrough if passthroughdom
        
        acl ssltermdom req.ssl_sni -i d.smalldragoon.com
        use_backend sslterm if ssltermdom
        
        # or use a default_backend directive

frontend frontsslterm
        mode http
        bind 127.0.0.1:445 ssl crt /var/ssl/private/
        default_backend httpbackend

backend httpbackend
        mode http
        server server1 192.168.1.2:80

backend passthrough
        mode tcp
        server server1 192.168.1.1:443

backend sslterm
        mode tcp
        server local 127.0.0.1:445
```

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 10, 2022, 11:39am UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/11 "2022-05-10T11:39:17Z")

</div>

hi @lukastribus , thanks a lot for all your help . So I understand indeed your suggestions on SNI matching and normal IP sockets.  
regarding now the “other features”, I’m using PfSense and the GUI is adding these extra’s.  
I checked all the options, checkboxes trying to be as close as possible updating the conf to get it matched with your sugested one :

```auto

listen HAProxyLocalStats
        bind 127.0.0.1:2200 name localstats
        mode http
        stats enable
        stats refresh 10
        stats admin if TRUE
        stats show-legends
        stats uri /haproxy/haproxy_stats.php?haproxystats=1
        timeout client 5000
        timeout connect 5000
        timeout server 5000

frontend Main-Frontend-SNI-and-redirect
        bind [MY PUBLIC IP]:443 name [MY PUBLIC IP]:443
        mode tcp
        log global
        timeout client 30000
        tcp-request inspect-delay 5s
        acl passthrough req.ssl_sni -i admin-poc.smalldragoon.com
        acl passthrough req.ssl_sni -i ssp-poc.smalldragoon.com
        acl joomla req.ssl_sni -i joomla.smalldragoon.com
        tcp-request content accept if { req.ssl_hello_type 1 }
		
        use_backend passtrough-smalldragoon.com-Server_ipvANY if passthrough
        use_backend SSLterm_ipvANY if joomla

frontend frontend-ssl-term
        bind 127.0.0.1:445 name 127.0.0.1:445
        mode tcp
        log global
        timeout client 30000
        default_backend httpbackend-portal-joomla_ipvANY

backend passtrough-smalldragoon.com-Server_ipvANY
        mode tcp
        id 104
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        server smalldragoon-com 192.168.1.69:443 id 105 check inter 1000

backend SSLterm_ipvANY
        mode tcp
        id 106
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        option httpchk OPTIONS /
        server sslterm 127.0.0.1:445 id 107 check inter 1000

backend httpbackend-portal-joomla_ipvANY
        mode tcp
        id 108
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        server portal 192.168.1.26:80 id 109 check inter 1000

```

The differences I see are the mode for http backend ( do not manage to switch it to http instead of tcp)  
When I try to access to [https://joomla.smalldragoon.com](https://joomla.smalldragoon.com), it is still redirected to the passtrhough site ( like he is not making a difference on the SNI )

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 10, 2022, 12:15pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/12 "2022-05-10T12:15:36Z")

</div>

`frontend frontend-ssl-term` is missing all the SSL configuration. It needs ssl and crt keywords with certificate.

And importantly:

> [@lukastribus](#):
>
> This all works only if the certificates do not overlap.

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 10, 2022, 1:58pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/13 "2022-05-10T13:58:57Z")

</div>

I tried to anonymize as less as possible for the certificate not overlaping.  
I have the SSL config in place now I think

```auto
frontend Main-Frontend-SNI-and-redirect
        bind [My Public IP]:443 name [My Public IP]:443
        mode tcp
        log global
        timeout client 30000
        tcp-request inspect-delay 5s
        acl passthrough req.ssl_sni -i admin-poc.smalldragoon.com
        acl passthrough req.ssl_sni -i ssp-poc.smalldragoon.com
        acl joomla req.ssl_sni -i joomla.smalldragoon.xyz
        tcp-request content accept if { req.ssl_hello_type 1 }
        use_backend passtrough-smalldragoon.com-Server_ipvANY if passthrough
        use_backend SSLterm_ipvANY if joomla

frontend frontend-ssl-term
        bind 127.0.0.1:445 name 127.0.0.1:445 ssl crt-list /var/etc/haproxy/frontend-ssl-term.crt_list
        mode http
        log global
        option http-keep-alive
        timeout client 30000
        acl aclcrt_frontend-ssl-term var(txn.txnhost) -m reg -i ^([^\.]*)\.smalldragoon\.xyz(:([0-9]){1,5})?$
        http-request set-var(txn.txnhost) hdr(host)
        http-request deny if { req.hdr_cnt(content-length) gt 1 }
        http-response deny if { res.hdr_cnt(content-length) gt 1 }
        use_backend httpbackend-portal-joomla_ipvANY if aclcrt_frontend-ssl-term

backend passtrough-smalldragoon.com-Server_ipvANY
        mode tcp
        id 104
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        server smalldragoon.com 192.168.1.69:443 id 105 check inter 1000

backend SSLterm_ipvANY
        mode tcp
        id 106
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        option httpchk OPTIONS /
        server sslterm 127.0.0.1:445 id 107 check inter 1000

backend httpbackend-portal-joomla_ipvANY
        mode http
        id 108
        log global
        timeout connect 30000
        timeout server 30000
        retries 3
        server portal 192.168.1.26:80 id 109 check inter 1000

```

but the SSL still says it is presenting the [smalldragoon.com](http://smalldragoon.com) instead of offloading for domain smalldragoon.xyz ( and therefore saying the cert domain is not matching )

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 10, 2022, 4:39pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/14 "2022-05-10T16:39:11Z")

</div>

I can’t really help you further at this point. Check haproxy logs and confirm that the correct routing decision are made. Check that the correct SSL certificate used for SSL termination.

Go step by step.

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 11, 2022, 7:57am UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/15 "2022-05-11T07:57:21Z")

</div>

OK, thanks you. will keep you posted.

---

<div class="post-metadata">

**Author:** ![smalldragoon](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@smalldragoon](https://discourse.haproxy.org/u/smalldragoon)\
**Post date:** [May 12, 2022, 11:43pm UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/16 "2022-05-12T23:43:57Z")

</div>

HI, just an update. I’m having trouble to get logs from haproxy with PFSense. I only get the stop /restart but no info on the routing.  
Will keep you posted once this solved and hopefully the main problem thanks to the logs

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 13, 2022, 7:08am UTC](https://discourse.haproxy.org/t/shared-frontends-how-to-do-ssl-of-loading-and-sni-forwarding/7612/17 "2022-05-13T07:08:44Z")

</div>

Check this for syslog configuration:

> [@How to enable HAProxy Stats Log](https://discourse.haproxy.org/t/how-to-enable-haproxy-stats-log/1738/2):
>
> You can find the details of the logging system in the documentation, section 8 [1]. As an example, here is a basic logging configuration: global log 127.0.0.1 syslog debug defaults log global mode http option httplog [1] [https://cbonte.github.io/haproxy-dconv/1.7/configuration.html#8](https://cbonte.github.io/haproxy-dconv/1.7/configuration.html#8)