Not working in TCP mode

I am setting up a new haproxy server (I have some haproxy experience years ago at a different job)

It will not be load balancing, it is only doing reverse proxy (forwarding requests to appropriate webserver based on domain name used in URL).

I am planning to use SSL passthrough (at this point I don’t think I have to terminate it at haproxy for any reason and I still have to have it enabled on the webservers so passthrough would be the simplest. But to do SSL passthrough I think I have to use TCP mode and I can’t get it to work.) probably just missing something really simple but I haven’t found it.

for simplicity here I have removed my https front end and backends and am now only testing using http on port 80, once I have that working I’ll go on to https… So with http it works no problem in http mode using the following config (edited to actual server and domain names):

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin
        stats timeout 30s
        user haproxy
        group haproxy
        daemon
        maxconn 4096

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHA>
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
#       option forwardfor
        maxconn 200
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

frontend haproxy-80
        bind *:80
#       mode tcp
#       option tcplog
        use_backend AM_http if { hdr(host) -i AM-dr.example.com }
        use_backend AR_http if { hdr(host) -i AR-dr.example.com }
        use_backend WS_http if { hdr(host) -i dr.WS-example.com }


backend AM_http
#        mode tcp
        server C33-WEBDR     10.2.33.10:80 check
backend AR_http
#        mode tcp
        server C01-WEBDR     10.2.1.10:80 check
backend WS_http
#        mode tcp
        server C17-WEBDR     10.2.17.10:80 check

but if I test switching to tcp mode I can’t access the websites anymore (my browser tells me “ERR_EMPTY_RESPONSE”) at this point all I am doing is setting “mode tcp” in my front end and backends. No change to Global or Defaults sections and the front and backends become:

frontend haproxy-80
        bind *:80
       mode tcp
       option tcplog
        use_backend AM_http if { hdr(host) -i AM-dr.example.com }
        use_backend AR_http if { hdr(host) -i AR-dr.example.com }
        use_backend WS_http if { hdr(host) -i dr.WS-example.com }


backend AM_http
        mode tcp
        server C33-WEBDR     10.2.33.10:80 check
backend AR_http
        mode tcp
        server C01-WEBDR     10.2.1.10:80 check
backend WS_http
        mode tcp
        server C17-WEBDR     10.2.17.10:80 check

what am I missing?

6 posts - 2 participants

Read full topic