HAProxy can't do it by itself, but if you used a set of fairly simple frontend/listen
declerations, you could use the iptables
TEE
target (see here for usage), it should be fairly simple.
For a system where the server's "public" IP is 10.10.10.10, who's backends are 192.168.1.11 and 192.168.1.12 and who's IDS is 172.16.172.10 the HAProxy configuration would look something like this:
listen IN
mode tcp
bind 10.10.10.10:443
<other HAProxy options/directives here>
server hap-intermediary 127.1.1.1:443
frontend INTERMEDIARY
mode http
bind 127.1.1.1:443 ssl crt /path/to/cert.pem
<other HAProxy options/directives here>
<backend selection logic, if needed>
default_backend SERVERS
backend SERVERS
<other HAProxy options/directives here>
server server1 192.168.1.11:443 check check-ssl ssl
server server2 192.168.1.12:443 check check-ssl ssl
This basically just passes all the traffic from IN
to INTERMEDIARY
in whatever shape it entered the server, and then INTERMEDIARY
decrypts the requests and make whatever choices you want.
You'd then need to setup iptables
rules that looks like this:
iptables -t mangle -A PREROUTING -d 127.1.1.1 -j TEE --gateway 172.16.172.10
iptables -t mangle -A POSTROUTING -s 127.1.1.1 -j TEE --gateway 172.16.172.10
Of course, this assumes all routes and networks are setup, but it should work.
I suppose you could just do away with all the HAProxy stuff and setup some iptables
rules to match your backend hosts and TEE
that traffic right to your IDS.
# Server 1
iptables -t mangle -A PREROUTING -d 192.168.1.11 -j TEE --gateway 172.16.172.10
iptables -t mangle -A POSTROUTING -s 192.168.1.11 -j TEE --gateway 172.16.172.10
# Server 2
iptables -t mangle -A PREROUTING -d 192.168.1.12 -j TEE --gateway 172.16.172.10
iptables -t mangle -A POSTROUTING -s 192.168.1.12 -j TEE --gateway 172.16.172.10