Adding HTTP host header verification to TlsProxy's HTTP protocol?

Question

Hello,
I wanted to ask if it's possible to add the ability to redirect (reverse-proxy) HTTP connections based on the HTTP 'Host' header.

If the inbound protocol is set to 'HTTP' then it would allow to give the desired HTTP Host domains and the rule would only be triggered for requests that have the correct hostname.

If the HTTP Host header contains a port number then a temporary new variable would be created for verification without the port number (e.g. 'forum.rebex.net:8080' would be verified as whether 'forum.rebex.net' matches the wanted hostnames, not the appended port number).

And the HTTP tunnels that have HTTP Host header verification would have priority over the default HTTP rule (the one without any, the default fallback rule).

The HTTP Host header verification would work like the serverNames option, as a list of comma-separated hostnames:

tunnels:

# First one to redirect e.g. FTP Web interface
# Listen on all interfaces
  - name: webftp-http

    in: { port: 80, protocol: HTTP }
    out: { address: 127.0.0.1, port: 7001, protocol: HTTP }

    httpXRealIp: true
    httpXForwardedFor: true

    httpHostnames: webftp.mydomain.com, ftp.mydomain.com

    idleTimeout: 300

# Second one to redirect e.g. IPcam Web interface
# 192.168.2.107 = IPcam LAN IP
  - name: ipcam-http

    in: { port: 80, protocol: HTTP }
    out: { address: 192.168.2.107, port: 8080, protocol: HTTP }

    httpXRealIp: true
    httpXForwardedFor: true

    httpHostnames: ipcam.mydomain.com, cam.mydomain.com, watch.mydomain.com

    idleTimeout: 300

# Last one as a fallback if no hostname matches
# Redirect to this PC's port 8080 default webserver
  - name: default-http

    in: { port: 80, protocol: HTTP }
    out: { address: 127.0.0.1, port: 8080, protocol: HTTP }

    httpXRealIp: true
    httpXForwardedFor: true

    idleTimeout: 300

This would greatly facilitate forwarding requests based on which website the user wants to visit, instead of only currently being able to redirect to one IP/port only.

-Thanks

Answer 1

Unfortunately, this is not possible with the current version of Rebex TLS Proxy, but it is planned feature. However, we have no exact schedule for it yet.