# TCP mode ACL does not kick in

**URL:** <https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816>\
**Category:** Help!\
**Created:** [August 12, 2021, 6:47pm UTC](https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816 "2021-08-12T18:47:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![henry](https://avatars.discourse-cdn.com/v4/letter/h/df705f/32.png) [@henry](https://discourse.haproxy.org/u/henry)\
**Post date:** [August 12, 2021, 6:47pm UTC](https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816/1 "2021-08-12T18:47:58Z")

</div>

ACL does not get excuted, seems like with tcp mode cannot match the domain  
can someone help please?  
frontend drs  
mode tcp  
bind \*:5432  
#default\_backend backend

```
    acl sifo_acl hdr(host) -i v3locitydev.com
    tcp-request inspect-delay 30s
    tcp-request content accept if sifo_acl
    tcp-request content reject

    #acl sifo_acl hdr(host) -i client1.v3locitydev.com
    acl antinacl hdr(host) -i client2.v3locitydev.com
    use_backend backend if sifo_acl
    use_backend antinbackend if antinacl

```

backend backend  
mode tcp  
server sifoclient [test.com:5432](http://test.com:5432)

---

<div class="post-metadata">

**Author:** ![Rfraile](https://avatars.discourse-cdn.com/v4/letter/r/50afbb/32.png) [@Rfraile](https://discourse.haproxy.org/u/Rfraile)\
**Post date:** [August 13, 2021, 9:12am UTC](https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816/2 "2021-08-13T09:12:05Z")

</div>

You need `mode http` to access to the layer7 content, like the host header.

---

<div class="post-metadata">

**Author:** ![henry](https://avatars.discourse-cdn.com/v4/letter/h/df705f/32.png) [@henry](https://discourse.haproxy.org/u/henry)\
**Post date:** [August 13, 2021, 3:51pm UTC](https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816/3 "2021-08-13T15:51:40Z")

</div>

u mean this cannot be done then? if i use http , the DB tool client will not work.  
Is there any i can make it work

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [August 13, 2021, 5:59pm UTC](https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816/4 "2021-08-13T17:59:51Z")

</div>

Then the DB tool client is not using HTTP.

`hdr(host)` access the Host header in a HTTP request, when in http mode. That’s it.

---

<div class="post-metadata">

**Author:** ![henry](https://avatars.discourse-cdn.com/v4/letter/h/df705f/32.png) [@henry](https://discourse.haproxy.org/u/henry)\
**Post date:** [August 16, 2021, 2:03pm UTC](https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816/5 "2021-08-16T14:03:36Z")

</div>

The DB tool is using port 5432 not port 80/443

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [August 16, 2021, 3:27pm UTC](https://discourse.haproxy.org/t/tcp-mode-acl-does-not-kick-in/6816/6 "2021-08-16T15:27:12Z")

</div>

Postgresql is not HTTP.