Welcome! Log In Create A New Profile


Re: TCP proxy with SNI support

Francis Daly
July 23, 2020 08:40AM
On Sun, Jul 19, 2020 at 07:39:55AM -0400, bitquest25c wrote:

Hi there,

> I have a single server with one Public IP and 10 domains. For each domain
> I’d like to have a separate docker container as an email server (Postfix +
> Dovecot). I’d like to achieve this with transparent TCP proxy with SNI
> support.
> I'd like to route traffic from example.com on ports 587 & 143 to one
> container and traffic for acme.com on ports 587 & 143 to a different
> container, etc.

Does the first example configuration at
http://nginx.org/en/docs/stream/ngx_stream_ssl_preread_module.html show
what you want?

And if not -- how will your tcp proxy know that some traffic to
your-ip:your-port is intended for one.example.com instead of for

> Should ports 587 & 143 be changed to 465 & 993 instead to achieve this?

It sounds like you want your clients to speak protocol-over-ssl, using
SNI. So you will want probably want smtps-on-465 and imaps-on-993, yes.

So long as you control the clients, and can require them to use your
configuration (SNI and these ports), it should work,

In this design, nginx is not doing SSL-termination; each individual
upstream service will do that.

Good luck with it,

Francis Daly francis@daoine.org
nginx mailing list
Subject Author Posted

TCP proxy with SNI support

bitquest25c July 19, 2020 07:39AM

Re: TCP proxy with SNI support

Francis Daly July 23, 2020 08:40AM

Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 89
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready