1

Looking for guidance of how to configure haproxy 2.4 in a container, to proxy for a mail server (all protocols, imap/s, smtp/s, pop3/s, http/s) and having haproxy doing ssl termination, but also sending properly to the encrypted ports (pop3s, imap/s, especially) on the backend mail server.

Here is my configuration:

 frontend smtp-in
  bind *:25
  mode tcp
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }
  use_backend smtp if { req_ssl_sni -i mailer.example.com }

frontend imap-in
  bind *:143
  mode tcp
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }
  use_backend imap if { req_ssl_sni -i mailer.example.com }

frontend smtps-in
  bind *:587 ssl crt /usr/local/etc/haproxy/ssl
  mode tcp
  tcp-request inspect-delay 5s
  use_backend smtps

frontend imaps-in
  bind *:993  ssl crt /usr/local/etc/haproxy/ssl
  mode tcp
  tcp-request inspect-delay 5s
  use_backend imaps

frontend pops-in
  bind *:995  ssl crt /usr/local/etc/haproxy/ssl
  mode tcp
  tcp-request inspect-delay 5s
  use_backend pops
  log /dev/log local0 info

frontend pop-in
  bind *:110
  mode tcp
  tcp-request inspect-delay 5s
  use_backend pop

backend smtp
  mode tcp
  server mailserver 192.168.2.254:25

backend imap
  mode tcp
  server mailserver 192.168.2.254:143

backend smtps
  mode tcp
  server mailserver 192.168.2.254:587

backend imaps
  mode tcp
  server mailserver 192.168.2.254:993

backend https
   mode tcp
   server mailserver 192.168.2.254:443

backend pop
   mode tcp
   server mailserver 192.168.2.254:110

backend pops
   mode tcp
   server mailserver 192.168.2.254:995

I am testing with pop3/s and so far requests are being rejected for SSL(pop3), and odd timeouts (pop3s).

Am I doing this correctly? Can someone please enlighten me?

Improve this question
2
  • Maybe this discussion can help somehow: discourse.haproxy.org/t/…
    – dashohoxha
    Commented May 8, 2023 at 9:57
  • Thanks, my takeaway from the discussion is 'But haproxy is definitely the wrong tool for this job.' I need to find something else.
    – Unpossible
    Commented May 8, 2023 at 12:24

1 Answer 1

Reset to default
1

From here 'https://discourse.haproxy.org/t/smtp-imap-proxy-based-on-domain-pass-through/5480' it appears that 'haproxy is the wrong tool for the job'.

Improve this answer
2
  • 1
    My opinion is that your approach (tcp proxy) is not the right one, because haproxy is one of the best tools for that. I believe that email tools (postfix etc.), if configured properly, can do what you are trying to achieve. But I am not able to show you how.
    – dashohoxha
    Commented May 11, 2023 at 8:45
  • Uhh .... thanks, I think?
    – Unpossible
    Commented May 12, 2023 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .