haproxy acl not working in https/tcp mode

Question

I am experiencing some problems, it seems I can't get acl's to work in tcp mode,
everything works in http mode.
Here is my config.

frontend  http *:80
    acl http_test_acl       path_beg    -i /test
    use_backend http_test   if http_test_acl
    default_backend         http_default

backend http_test
    balance   roundrobin
    server    httptest 10.10.10.10:80 check

backend http_default
    balance   roundrobin
    server    httpdefault 10.10.10.10:80 check

############# HTTPS #################
frontend  https *:443
    mode tcp
    acl https_test_acl         path_beg -i /test
    use_backend https_test     if https_test_acl
    default_backend            https_default

backend https_test
    mode tcp
    balance   roundrobin
    server    httpstest 10.10.10.10:443 check

backend https_default
    mode tcp
    balance   roundrobin
    server    httpsdefault 10.10.10.10:443 check

Don't pay attention to ip 10.10.10.10 as I have hidden my orginal one. Could you please let me know why https is not working, http frontend/backend acl rules are working just fine.

cheers

Fresher

Answer 1

Cause your https servers are in tcp mode (as they should be for ssl), so a layer 7 rule wont work.

Cawthon

Answer 2

for acl to work, disable tcp mode then set up ssl on the servers on your backend(hence the ssl keyword)

frontend  https *:443
    acl https_test_acl      path_beg    -i /test
    use_backend     https_test  if https_test_acl
    default_backend             https_default

backend https_test
    balance   roundrobin
    server    httpstest 10.10.10.10:443 ssl check

backend https_default
    balance     roundrobin
    server  httpsdefault 10.10.10.10:443 ssl check

Alternatively instead of having to setup ssl on both your backend servers; use private IPS in the backend servers and make sure ports on the backend servers arent open to the world

    backend https_test
    balance   roundrobin
    server    httpstest some_private_ip:8000 check

Launch