title: HAProxy http-request deny and SNI
body: <p>I have the following configuration:</p>
  <pre><code>global
    demon
    maxconn 256
    log / dev / log local0 debug
  
  defaults
    option httplog
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms
  
  frontend http_in
    mode tcp
    bind *: 80
    bind *: 443
  
  tcp-request inspect-delay 5s
    acl sslv3 req.ssl_ver 3
    tcp-request content reject if sslv3
    tcp-request content accept if {req_ssl_hello_type 1}
    
    acl test1 req_ssl_sni -i test1.domain.abc
    acl test2 req_ssl_sni -i test2.domain.abc
  
    use_backend Test1_ssl if test1
    use_backend Test2_ssl if test2
  
  backend Test1_ssl
    mode tcp
    stick-table type binary len 32 size 30k expire 30m
    
    acl clienthello req_ssl_hello_type 1
    acl serverhello req_ssl_hello_type 2
  
  `# use tcp content accepts to detects ssl client and server hello.`
  
  tcp-request inspect-delay 5s
    tcp-request content accept if clienthello
  
    # no timeout on response inspect delay by default.
    tcp-response content accept if serverhello
  
    stick on payload_lv (43,1) if clienthello
  
    # Learn on response if server hello.
    stick store-response payload_lv (43,1) if serverhello
  
    option ssl-hello-chk
    server Test1 xxx.xxx.xxx.xxx:443
  
  backend Test2_ssl
    mode tcp
    stick-table type binary len 32 size 30k expire 30m
  
    acl clienthello req_ssl_hello_type 1
    acl serverhello req_ssl_hello_type 2
  
    # use tcp content accept to detects ssl client and server hello.
    tcp-request inspect-delay 5s
    tcp-request content accept if clienthello
  
    # no timeout on response inspect delay by default.
    tcp-response content accept if serverhello
  
    stick on payload_lv (43,1) if clienthello
  
    #Learn on response if server hello.
    stick store-response payload_lv (43,1) if serverhello
  
    option ssl-hello-chk
    server Test2 xxx.xxx.xxx.xxx:443
  </code></pre>
  <p>Now I want the function for Test1_ssl that all requests are automatically forwarded to the path / forwarding path.</p>
  <p>After I couldn't find any functions for this in haproxy, I tried &quot;http-request deny&quot; to forbid all requests to other paths except path / forwarding path.</p>
  <p>For this I used the following:</p>
  <pre><code>acl is_static path -i -m beg / forwarding path
  http request deny if is_static
  </code></pre>
  <p>No matter where I use this in my code, it has no effect - all paths are always accessible.</p>
  <p>My guess is that it's up to SNI. Does anyone know if there is a way to implement this in my configuration?</p>
  <p>Many Thanks</p>