HAProxy reverse proxy SNI wildcard

Question

I need some help with my HAProxy config. I am currently using HAProxy 1.5 to access geoblocked websites by reverse proxying them through altered DNS entries. (https://github.com/trick77/tunlr-style-dns-unblocking).

Now I stumbled upon a problem as I have to proxy many subdomains of one server (lets say abc.xyz.com, def.xyz.com, ...). Is it possible to create a wildcard for my config by using something like *.xyz.com and that actually works with SNI and all subdomains of this domain?

Thank you very much in advance!

global
  daemon
  maxconn 200
  user haproxy
  group haproxy
  stats socket /var/run/haproxy.sock mode 0600 level admin
  log /dev/log  local0 debug
  pidfile /var/run/haproxy.pid
  spread-checks 5

defaults
  maxconn 195
  log global
  mode http
  option httplog
  option abortonclose
  option http-server-close
  option persist
  option accept-invalid-http-response

  timeout connect 20s
  timeout server 120s
  timeout client 120s
  timeout check 10s
  retries 3

# catchall ------------------------------------------------------------------------

frontend f_catchall
  mode http
  bind *:80
  log global
  option httplog
  option accept-invalid-http-request

  capture request  header Host len 50
  capture request  header User-Agent len 150

  #--- xyz.com
  use_backend b_catchall     if { hdr(host) -i abc.xyz.com }


  default_backend b_deadend

backend b_catchall
  log global
  mode http
  option httplog
  option http-server-close

  #--- xyz.com
  use-server abc.xyz.com                    if { hdr(host) -i abc.xyz.com }
  server abc.xyz.com abc.xyz.com:80 check inter 10s fastinter 2s downinter 2s fall 1800

frontend f_catchall_sni
  bind *:443
  mode tcp
  log global
  option tcplog
  no option http-server-close

  tcp-request inspect-delay 5s
  tcp-request content accept               if { req_ssl_hello_type 1 }

  #--- abc
  use_backend b_catchall_sni               if { req_ssl_sni -i abc.xyz.com }

  default_backend b_deadend_sni

backend b_catchall_sni
  log global
  option tcplog
  mode tcp
  no option http-server-close
  no option accept-invalid-http-response

  #---xyz.com
  use-server abc.xyz.com                    if { req_ssl_sni -i abc.xyz.com }
  server abc.xyz.com abc.xyz.com:443 check inter 10s fastinter 2s downinter 2s fall 1800

# deadend ------------------------------------------------------------------------

backend b_deadend
  mode http
  log global
  option httplog

backend b_deadend_sni
  mode tcp
  log global
  option tcplog
  no option accept-invalid-http-response
  no option http-server-close

Oocyte

Answer 1

I finally found a solution. It wasn't in the documentation though.

Use -m end instead of -i for wildcard

if { req.ssl_sni -m end .abc.xyz.com }

Georginageorgine

Answer 2

You can using ssl_fc_sni. Something like this works:

use_backend api if { ssl_fc_sni api.example.com }
use_backend web if { ssl_fc_sni app.example.com }

Mortise

Answer 3

If someone struggling why it's not working, I was missing this on the frontend:

tcp-request inspect-delay 3s

Dispread