TCP proxy with SNI support
francis at daoine.org
Thu Jul 23 12:38:30 UTC 2020
On Sun, Jul 19, 2020 at 07:39:55AM -0400, bitquest25c wrote:
> I have a single server with one Public IP and 10 domains. For each domain
> I’d like to have a separate docker container as an email server (Postfix +
> Dovecot). I’d like to achieve this with transparent TCP proxy with SNI
> I'd like to route traffic from example.com on ports 587 & 143 to one
> container and traffic for acme.com on ports 587 & 143 to a different
> container, etc.
Does the first example configuration at
what you want?
And if not -- how will your tcp proxy know that some traffic to
your-ip:your-port is intended for one.example.com instead of for
> Should ports 587 & 143 be changed to 465 & 993 instead to achieve this?
It sounds like you want your clients to speak protocol-over-ssl, using
SNI. So you will want probably want smtps-on-465 and imaps-on-993, yes.
So long as you control the clients, and can require them to use your
configuration (SNI and these ports), it should work,
In this design, nginx is not doing SSL-termination; each individual
upstream service will do that.
Good luck with it,
Francis Daly francis at daoine.org
More information about the nginx