Hi, I’m using haproxy through PfSense and as I’m not able to have my conf working, I was wondering if what I need is possible or not, hence my question here. here is a recap of my need : I have 1 single public IP address, I need the following at the same time : I have a domain , smalldragoon.co…

well…up ? just at least to know if iti is posisble or not ?

It’s possible, you need a TCP frontend that SNI routes the traffic as necessary. The SSL session that you want to terminate you router to SSL terminating frontend on another port of the same haproxy instance, so you are able to have both. This all works only if the certificates do not overlap.

Hi @lukastribus , thanks for your answer. let me rephrase to be sure I understand correctly : I have 2 domain A and B I want to terminate B and fw A as is to internal So based on SNI, single frontend, I for A domain, FW to my internal host for B : redirect to port 12345 then create another fr…

[image] smalldragoon: for B : redirect to port 12345 then create another frontend on port 12345 , which will do SSL termination Exactly.

Thanks a lot ! I will play in the next couple of days ! Thanks

Hi, As I still can’t get it working , I decided to proceed step by step. 1 - re-started from a blank complete config. 2 - created a front end with SNI on port 443, with each Server Name Indication TLS extension matches X1.smalldragoon.com to an action ( X1 to x1, X2 to x2 …). Action beiing : x1…

Post the full configuration, otherwise it’s difficult to get a complete picture of the situation.

sure, here we go then global maxconn 1500 log /var/run/log local0 debug stats socket /tmp/haproxy.socket level admin expose-fd listeners uid 80 gid 80 nbproc …

A few suggestions: you only need to match SNI in one frontend (the one listening on port 443) start using normal IP sockets for the backend → frontend re-circulation, thats less complex don’t start adding features when your basic configuration doesn’t work. Don’t use proxy-protocol on the first tr…

hi @lukastribus , thanks a lot for all your help . So I understand indeed your suggestions on SNI matching and normal IP sockets. regarding now the “other features”, I’m using PfSense and the GUI is adding these extra’s. I checked all the options, checkboxes trying to be as close as possible updat…

Shared Frontends - how to do SSL of loading and SNI forwarding

Help!

lukastribus May 13, 2022, 7:08am 17

Check this for syslog configuration:

Topic		Replies	Views
Using HAproxy to terminate SNI and port forwarding Help!	6	2299	January 18, 2024
Mixing mode tcp and http - SSL termination and Passthrough Help!	19	43217	September 19, 2025
Apache multiple SSL VirtualHost single IP and port Help!	17	1927	November 28, 2022
Not working in TCP mode Help!	10	3387	July 23, 2024
Multiple bind a.com:443 b.com:443 lines Yes/No? Help!	3	1787	March 4, 2020

Shared Frontends - how to do SSL of loading and SNI forwarding

Related topics