The original post: /r/nginx by /u/listhor on 2025-03-03 14:36:57.

I can’t get all SNI to be recognised when connecting to proxy stream. I mean only 2 out of 3 SNI are recognised and mapped by nginx. I can see in log that remaining 1 is assigned to default upstream backend. I tried connecting using browser and openssl:

openssl s_client -connect 1.example.com:443 -servername 1.example.com

Nginx is behind opnsense firewall with port forwarding WAN 443 -> LAN 1443

Code I use:

log_format log_stream '$remote_addr - [$time_local] $protocol [$ssl_preread_server_name] [$ssl_preread_alpn_protocols] [$upstream_name] ' '$status $bytes_sent $bytes_received $session_time';

map $ssl_preread_server_name $upstream {
    1.example.com 1;
    2.example.com 2;
    3.example.com 3;
    default 4;
}

server {
    listen 10.10.0.13:1443;
    error_log /var/log/nginx/error_mainstream.log;
    ssl_preread on;
    proxy_protocol on;
    proxy_pass $upstream;
    access_log /var/log/nginx/access_mainstream.log log_stream;

upstream 1 {
    hash $remote_addr consistent;
    server 127.0.0.1:4443;
}

upstream 2 {
    hash $remote_addr consistent;
    server 127.0.0.1:5443;
}

upstream 3 {
    hash $remote_addr consistent;
    server 127.0.0.1:6443;
}

upstream 4 {
    hash $remote_addr consistent;
    server 127.0.0.1:7443;
}

How to troubleshoot it further or what could have been a reason for that? I’m suspecting firewall issue but it doesn’t make sense to me (there’s one forwarding rule).