# Stuck with Server Connection Failed problem

**URL:** <https://discourse.haproxy.org/t/stuck-with-server-connection-failed-problem/3600>\
**Category:** Help!\
**Created:** [March 8, 2019, 7:28pm UTC](https://discourse.haproxy.org/t/stuck-with-server-connection-failed-problem/3600 "2019-03-08T19:28:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aminnesotaman](https://avatars.discourse-cdn.com/v4/letter/a/f05b48/32.png) [@aminnesotaman](https://discourse.haproxy.org/u/aminnesotaman)\
**Post date:** [March 8, 2019, 7:28pm UTC](https://discourse.haproxy.org/t/stuck-with-server-connection-failed-problem/3600/1 "2019-03-08T19:28:14Z")

</div>

Hello,

I have haproxy setup as a reverse proxy to serve several web applications. I have it set to pass through ssl. I’ve added a site that is hosted in IIS 10. I have a letsencrypt certificate for it. If I configure the web server without going through the proxy, it works. However, when I add haproxy, browsers give me a Server Connection Failed or similar. I’m stuck. Below is a portion of my config. IPOLPROD is the backend in question.

> frontend https  
> bind \*:443  
> mode tcp  
> option tcplog  
> tcp-request inspect-delay 5s  
> tcp-request content accept if { req\_ssl\_hello\_type 1 }
> 
> ###ACCESS CONTROL LISTS###
> 
> #acl for nextcloudprod  
> acl host\_nextcloudprod req\_ssl\_sni -i [nc.example.com](http://nc.example.com)
> 
> #acl for desktopcentral  
> acl host\_desktopcentral req\_ssl\_sni -i [medc.example.com](http://medc.example.com)
> 
> #acl for ipolprod  
> acl host\_ipolprod req\_ssl\_sni -i [inventory.example.com](http://inventory.example.com)
> 
> #acl for rocketchat  
> acl host\_rocketchat req\_ssl\_sni -i [chat.example.com](http://chat.example.com)
> 
> #redirect for nextcloud  
> use\_backend nextcloudprod-https if host\_nextcloudprod
> 
> #redirect for desktopcentral  
> use\_backend desktopcentral-https if host\_desktopcentral
> 
> #redirect for ipolprod  
> use\_backend ipolprod-https if host\_ipolprod
> 
> #redirect for rocket-chat  
> use\_backend rocketchat-https if host\_rocketchat
> 
> backend nextcloudprod-https  
> mode tcp  
> option tcplog  
> option forwardfor  
> option ssl-hello-chk  
> server nextcloudprod 192.168.1.253:9501 check
> 
> #backend desktopcentral-https
> 
> # mode tcp
> 
> # option forwardfor
> 
> # option ssl-hello-chk
> 
> # server desktopcentral 192.168.1.112:8443 check
> 
> backend ipolprod-https  
> mode tcp  
> option tcplog  
> option forwardfor  
> server ipolprod 192.168.1.210:443 check
> 
> #backend rocketchat-https  
> mode tcp  
> option forwardfor  
> option ssl-hello-chk  
> server rocketchat 192.168.1.118:443 check

---

<div class="post-metadata">

**Author:** ![ciprian.craciun](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/ciprian.craciun/32/722_2.png) [@ciprian.craciun](https://discourse.haproxy.org/u/ciprian.craciun)\
**Post date:** [March 10, 2019, 10:30am UTC](https://discourse.haproxy.org/t/stuck-with-server-connection-failed-problem/3600/2 "2019-03-10T10:30:36Z")

</div>

Could you perhaps try to `curl -v -s -o /dev/null https://nc.example.com/` and see if that works?

(Perhaps try to take a look with Wireshark to see what happens.)

Also the `option forwardfor` is not usable in case of `mode tcp`. (Although I doubt this is the case.)