@kevin-dafm wrote:
Hello HAProxy community,
I have HAProxy acting as Load Balancer to a Kubernetes Cluster. I have a wildcard DNS entry for my “public” IP address on the HAProxy. I also have a wild card TLS Certificate.
When I deploy a new application on Kubernetes it appears as new_application.mykyubdomain.com. Internally I access this no problem. This is combination of wild card DNS, TLS SNI and HAProxy magic working.
I would like to block a single application (TLS SNI) on the HAProxy. So my understanding is I need to inspect the SNI to see which application (TLS SNI) I am looking at and block it using tcp-request content reject.
This a snippet from the frontend section of my HAProxy settings for Kubernetes Cluster.
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
acl stop_app_ssl req_ssl_sni new_application1.mykyubdomain.com
tcp-request content reject if stop_app_sslThis is all in mode tcp as it is TLS traffic. The TLS termination is on the Kubernetes Cluster. I am not off loading the encryption to the HAProxy.
I have set-up Wireshark and can the SNI “new_application1.mykyubdomain.com” in TLS extension SNI when I connect to new_application1 but HAProxy does not block the traffic.
What am I doing wrong? Any advice much appreciated. If I have not made anything clear please ask.
Best Regards,
Kevin.
Posts: 1
Participants: 1