Re: TCP ACL rules based on host name

[Igor Cicimov]

On 22 Sep 2017 11:15 am, "rt3p95qs" <rt3p9...@gmail.com> wrote:

Is it possible to assign TCP (no HTTP) connections to a backend based on an
alias haproxy has?

For example:
HAProxy has 3 alias names, server01.example.com, server02.example.com and
server03.example.com.

The haproxy.conf file defines a front end and 3 back ends:

frontend static-svc
   bind *:80
   mode tcp
   option tcplog
   default_backend svc-svc-default


backend stactic-svc01
    balance source
    option tcplog
    server server01 127.0.0.1 check

backend static-svc02
    balance source
    option tcplog
    server server02 127.0.0.2 check

backend static-svc03
    balance source
    option tcplog
    server server03 127.0.0.3 check

The idea being that each static-service should only service in coming
requests thru a specific alias; therefore, requests coming from the
internet looking for server01.example.com would be sent to the static-svc01
back end. I have seen tons of examples on how to do this with HTTP, but I
can't find any that focus on pure TCP. My application does not use HTTP at
all.

Thanks.


Hmmm in case of ssl you could do something like this using the sni
extension:

tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
use_backend  sratic-svc01 if { req.ssl_sni -i server01.example.com }

otherwise not sure how can you access the host header in the tcp stream.