TCP proxy with SNI support

Francis Daly francis at
Thu Jul 23 12:38:30 UTC 2020

On Sun, Jul 19, 2020 at 07:39:55AM -0400, bitquest25c wrote:

Hi there,

> I have a single server with one Public IP and 10 domains. For each domain
> I’d like to have a separate docker container as an email server (Postfix +
> Dovecot). I’d like to achieve this with transparent TCP proxy with SNI
> support.
> I'd like to route traffic from on ports 587 & 143 to one
> container and traffic for on ports 587 & 143 to a different
> container, etc.

Does the first example configuration at show
what you want?

And if not -- how will your tcp proxy know that some traffic to
your-ip:your-port is intended for instead of for

> Should ports 587 & 143 be changed to 465 & 993 instead to achieve this?

It sounds like you want your clients to speak protocol-over-ssl, using
SNI. So you will want probably want smtps-on-465 and imaps-on-993, yes.

So long as you control the clients, and can require them to use your
configuration (SNI and these ports), it should work,

In this design, nginx is not doing SSL-termination; each individual
upstream service will do that.

Good luck with it,

Francis Daly        francis at

More information about the nginx mailing list