With the release of TCP load balancing for the Nginx community version, I would like to mix OpenVPN and SSL pass-through data. The only way for Nginx to know how to route the traffic is via their domain name.
vpn1.app.com ─┬─► nginx at 10.0.0.1 ─┬─► vpn1 at 10.0.0.3 vpn2.app.com ─┤ ├─► vpn2 at 10.0.0.4 https.app.com ─┘ └─► https at 10.0.0.5
I have taken a look at the TCP guides and the module documentation, but it doesn't seem well referenced. If anyone can point me to the right direction, i'd be grateful.
Related question on ServerFault: Can a Reverse Proxy use SNI with SSL pass through?
This is now possible with the addition of the ngx_stream_ssl_preread module added in Nginx 1.11.5 and the ngx_stream_map module added in 1.11.2.
This allows Nginx to read the TLS Client Hello and decide based on the SNI extension which backend to use.
stream { map $ssl_preread_server_name $name { vpn1.app.com vpn1_backend; vpn2.app.com vpn2_backend; https.app.com https_backend; default https_default_backend; } upstream vpn1_backend { server 10.0.0.3:443; } upstream vpn2_backend { server 10.0.0.4:443; } upstream https_backend { server 10.0.0.5:443; } upstream https_default_backend { server 127.0.0.1:443; } server { listen 10.0.0.1:443; proxy_pass $name; ssl_preread on; } }
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With