I'm trying to setup HAProxy to do simple tcp passthrough to different backends based on SNI. However, I have serious issues on my clients if I do so:
- Firefox: PR_END_OF_FILE_ERROR
- Brave/Chrome/Safari: ERR_CONNECTION_CLOSED (works after several reloads but the error shows again intermittently)
If I contact the backends directly, bypassing HAProxy, I have no such issues. So something in HAProxy is not configured right but I fail to see what it is.
- HA-Proxy version 2.0.14
- Running on OPNsense 20.1.x, 20.7.x (FreeBSD 11.2, 12.1)
- In a virtual machine on ESXi 6.7U3
My config looks like this:
global # NOTE: Could be a security issue, but required for some feature. uid 80 gid 80 chroot /var/haproxy daemon stats socket /var/run/haproxy.socket group proxy mode 775 level admin nbproc 1 nbthread 1 tune.ssl.default-dh-param 1024 spread-checks 0 tune.chksize 16384 tune.bufsize 16384 tune.lua.maxmem 0 log /var/run/log local0 info defaults log global option redispatch -1 timeout client 30s timeout connect 30s timeout server 30s retries 3 # Frontend: https_passthrough (https tcp mode main ip) frontend https_passthrough bind x.x.x.x:443 name x.x.x.x:443 mode tcp # tuning options timeout client 30s # logging options # ACL: service_sni acl acl_5f34555b7fae76.76760871 req.ssl_sni -i service.example.com # ACTION: service_https_passthrough use_backend service_https_passthrough if acl_5f34555b7fae76.76760871 # WARNING: pass through options below this line tcp-request inspect-delay 10s # Backend: service_https_passthrough () backend service_https_passthrough # health checking is DISABLED mode tcp balance source # stickiness stick-table type ip size 50k expire 30m stick on src # tuning options timeout connect 30s timeout server 30s server service_https_passthrough 10.0.1.105:443
If the connection fails I find entries like
https_passthrough https_passthrough/<NOSRV> -1/-1/0 0 SC 1/1/0/0/0 0/0
in the logs. But as I said, the backend servers are up and running 24/7 and work fine all day from internal LAN (also routing/firewall/VLANs involved here) so I doubt it is a firewall issue.
Any help appreciated.