lan-haproxy.cfg

# Check the HAProxy documentation for information about the configuration keywords.
# Make sure to use (compile) the latest HAProxy version from the current development branch or some features may not work!
#
# This configuration is modified from the one here: https://github.com/trick77/tunlr-style-dns-unblocking/blob/master/haproxy.conf

global
  daemon
  maxconn 20000
  user haproxy
  group haproxy
  stats socket /var/run/haproxy.sock mode 0600 level admin
  log /dev/log  local0 debug
  pidfile /var/run/haproxy.pid
  spread-checks 5

defaults
  maxconn 19500
  log global
  mode http
  option httplog
  option abortonclose
  option http-server-close
  option persist
  option accept-invalid-http-response

  timeout connect 20s
  timeout server 120s
  timeout client 120s
  timeout check 10s
  retries 3

listen stats    # Website with useful statistics about our HAProxy frontends and backends
  bind *:6969
  mode http
  stats enable
  stats realm HAProxy
  stats uri /
  stats auth haproxy:changethispassword

# SNI catchall ------------------------------------------------------------------------
# We're trying to save as many IP addresses as possible that's why we're running as many backends as possible on one IP address.
# Obviously, we're using SNI on the 443 frontend only

frontend f_sni_catchall
  mode http
  bind 192.168.0.101:80
  log global
  option httplog
  option accept-invalid-http-request

  capture request  header Host len 50
  capture request  header User-Agent len 150

  #--- netflix 
  use_backend b_sni_catchall     if { hdr(host) -i www.netflix.com }
  use_backend b_sni_catchall     if { hdr(host) -i appboot.netflix.com }
  use_backend b_sni_catchall     if { hdr(host) -i cbp-us.nccp.netflix.com }
  use_backend b_sni_catchall     if { hdr(host) -i a248.e.akamai.net }

  default_backend b_sni_deadend

backend b_sni_catchall
  log global
  mode http
  option httplog
  option http-server-close

  #--- netflix
  use-server www.netflix.com            if { hdr(host) -i www.netflix.com }
  server www.netflix.com 1.2.3.4:80

  use-server appboot.netflix.com        if { hdr(host) -i appboot.netflix.com }
  server appboot.netflix.com 1.2.3.4:80
  
  use-server cbp-us.nccp.netflix.com    if { hdr(host) -i cbp-us.nccp.netflix.com }
  server cbp-us.nccp.netflix.com 1.2.3.4:80

  use-server a248.e.akamai.net          if { hdr(host) -i a248.e.akamai.net }
  server a248.e.akamai.net 1.2.3.4:80

frontend f_sni_catchall_ssl
  bind 192.168.0.101:443
  mode tcp
  log global
  option tcplog
  no option http-server-close

  tcp-request inspect-delay 5s
  tcp-request content accept         if { req_ssl_hello_type 1 }

  #--- netflix
  use_backend b_sni_catchall_ssl     if { req_ssl_sni -i www.netflix.com }
  use_backend b_sni_catchall_ssl     if { req_ssl_sni -i appboot.netflix.com }
  use_backend b_sni_catchall_ssl     if { req_ssl_sni -i cbp-us.nccp.netflix.com }
  use_backend b_sni_catchall_ssl     if { req_ssl_sni -i a248.e.akamai.net }

  default_backend b_deadend_ssl

backend b_sni_catchall_ssl
  log global
  option tcplog
  mode tcp
  no option http-server-close
  no option accept-invalid-http-response

  #--- netflix
  use-server www.netflix.com                    if { req_ssl_sni -i www.netflix.com }
  server www.netflix.com 1.2.3.4:443

  use-server appboot.netflix.com            if { req_ssl_sni -i appboot.netflix.com }
  server appboot.netflix.com 1.2.3.4:443

  use-server cbp-us.nccp.netflix.com            if { req_ssl_sni -i cbp-us.nccp.netflix.com }
  server cbp-us.nccp.netflix.com 1.2.3.4:443

  use-server a248.e.akamai.net              if { req_ssl_sni -i a248.e.akamai.net }
  server a248.e.akamai.net 1.2.3.4:443

# netflix:signup  ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_signup
  log global
  option httplog
  bind 192.168.0.102:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_signup

backend b_netflix_signup
  log global
  option httplog
  mode http
  server signup.netflix.com 1.2.3.4:8002

frontend f_netflix_signup_ssl
  log global
  option tcplog
  bind 192.168.0.102:443
  mode tcp
  default_backend b_netflix_signup_ssl

backend b_netflix_signup_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server signup.netflix.com 1.2.3.4:9002

# netflix:api-global ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_api_global
  log global
  option httplog
  bind 192.168.0.103:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_api_global

backend b_netflix_api_global
  log global
  option httplog
  mode http
  server api-global.netflix.com 1.2.3.4:8003
  
frontend f_netflix_api_global_ssl
  log global
  option tcplog
  bind 192.168.0.103:443
  mode tcp
  default_backend b_netflix_api_global_ssl

backend b_netflix_api_global_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server api-global.netflix.com 1.2.3.4:9003

# netflix:movies ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_movies
  log global
  option httplog
  bind 192.168.0.104:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_movies

backend b_netflix_movies
  log global
  option httplog
  mode http
  server movies.netflix.com 1.2.3.4:8004

frontend f_netflix_movies_ssl
  log global
  option tcplog
  bind 192.168.0.104:443
  mode tcp
  default_backend b_netflix_movies_ssl

backend b_netflix_movies_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server movies.netflix.com 1.2.3.4:9004

# netflix:secure ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_secure
  log global
  option httplog
  bind 192.168.0.105:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_secure

backend b_netflix_secure
  log global
  option httplog
  mode http
  server secure.netflix.com 1.2.3.4:8005

frontend f_netflix_secure_ssl
  log global
  option tcplog
  bind 192.168.0.105:443
  mode tcp
  default_backend b_netflix_secure_ssl

backend b_netflix_secure_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server secure.netflix.com 1.2.3.4:9005

# netflix:moviecontrol ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_moviecontrol
  log global
  option httplog
  bind 192.168.0.106:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_moviecontrol

backend b_netflix_moviecontrol
  log global
  option httplog
  mode http
  server moviecontrol.netflix.com 1.2.3.4:8006

frontend f_netflix_moviecontrol_ssl
  log global
  option tcplog
  bind 192.168.0.106:443
  mode tcp
  default_backend b_netflix_moviecontrol_ssl

backend b_netflix_moviecontrol_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server moviecontrol.netflix.com 1.2.3.4:9006

# netflix:api ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_api
  log global
  option httplog
  bind 192.168.0.107:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_api

backend b_netflix_api
  log global
  option httplog
  mode http
  server api.netflix.com 1.2.3.4:8007

frontend f_netflix_api_ssl
  log global
  option tcplog
  bind 192.168.0.107:443
  mode tcp
  default_backend b_netflix_api_ssl

backend b_netflix_api_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server api.netflix.com 1.2.3.4:9007

# netflix:api-us ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_api_us
  log global
  option httplog
  bind 192.168.0.108:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_api_us

backend b_netflix_api_us
  log global
  option httplog
  mode http
  server api-us.netflix.com 1.2.3.4:8008

frontend f_netflix_api_us_ssl
  log global
  option tcplog
  bind 192.168.0.108:443
  mode tcp
  default_backend b_netflix_api_us_ssl

backend b_netflix_api_us_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server api-us.netflix.com 1.2.3.4:9008

# netflix:uiboot ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_uiboot
  log global
  option httplog
  bind 192.168.0.109:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_uiboot

backend b_netflix_uiboot
  log global
  option httplog
  mode http
  server uiboot.netflix.com 1.2.3.4:8009

frontend f_netflix_uiboot_ssl
  log global
  option tcplog
  bind 192.168.0.109:443
  mode tcp
  default_backend b_netflix_uiboot_ssl

backend b_netflix_uiboot_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server uiboot.netflix.com 1.2.3.4:9009

# netflix:cbp ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_cbp
  log global
  option httplog
  bind 192.168.0.110:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_cbp

backend b_netflix_cbp
  log global
  option httplog
  mode http
  server cbp.nccp.netflix.com 1.2.3.4:8010

frontend f_netflix_cbp_ssl
  log global
  option tcplog
  bind 192.168.0.110:443
  mode tcp
  default_backend b_netflix_cbp_ssl

backend b_netflix_cbp_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server cbp.nccp.netflix.com 1.2.3.4:9010

# netflix:ios ------------------------------------------------------------------------
# iOS devices use this domain.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_ios
  log global
  option httplog
  bind 192.168.0.111:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_ios

backend b_netflix_ios
  log global
  option httplog
  mode http
  server ios.nccp.netflix.com 1.2.3.4:8011

frontend f_netflix_ios_ssl
  log global
  option tcplog
  bind 192.168.0.111:443
  mode tcp
  default_backend b_netflix_ios_ssl

backend b_netflix_ios_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server ios.nccp.netflix.com 1.2.3.4:9011

# netflix:xbox ------------------------------------------------------------------------
# The Xbox 360 uses this domain and it doesn't support SNI. That's why this backend needs its own IP address.

frontend f_netflix_xbox
  log global
  option httplog
  bind 192.168.0.112:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_xbox

backend b_netflix_xbox
  log global
  option httplog
  mode http
  server xbox.nccp.netflix.com 1.2.3.4:8012

frontend f_netflix_xbox_ssl
  log global
  option tcplog
  bind 192.168.0.112:443
  mode tcp
  default_backend b_netflix_xbox_ssl

backend b_netflix_xbox_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server xbox.nccp.netflix.com 1.2.3.4:9012

# netflix:nrdp-31 ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.

frontend f_netflix_nrdp-31
  log global
  option httplog
  bind 192.168.0.113:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_nrdp-31

backend b_netflix_nrdp-31
  log global
  option httplog
  mode http
  server nccp-nrdp-31.cloud.netflix.net 1.2.3.4:8013

frontend f_netflix_nrdp-31_ssl
  log global
  option tcplog
  bind 192.168.0.113:443
  mode tcp
  default_backend b_netflix_nrdp-31_ssl

backend b_netflix_nrdp-31_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server nccp-nrdp-31.cloud.netflix.net 1.2.3.4:9013

# netflix:nintendo  ------------------------------------------------------------------------
# Nintendo Wii uses this domain and it doesn't support SNI. That's why this backend needs its own IP address.

frontend f_netflix_nintendo
  log global
  option httplog
  bind 192.168.0.114:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_nintendo

backend b_netflix_nintendo
  log global
  option httplog
  mode http
  server nintendo.nccp.netflix.com 1.2.3.4:8014

frontend f_netflix_nintendo_ssl
  log global
  option tcplog
  bind 192.168.0.114:443
  mode tcp
  default_backend b_netflix_nintendo_ssl

backend b_netflix_nintendo_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server nintendo.nccp.netflix.com 1.2.3.4:9014

# netflix:playstation ------------------------------------------------------------------------
# The PS3 uses this domain and it doesn't support SNI. That's why this backend needs its own IP address.

frontend f_netflix_playstation
  log global
  option httplog
  bind 192.168.0.115:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_playstation

backend b_netflix_playstation
  log global
  option httplog
  mode http
  server playstation.nccp.netflix.com 1.2.3.4:8015

frontend f_netflix_playstation_ssl
  log global
  option tcplog
  bind 192.168.0.115:443
  mode tcp
  default_backend b_netflix_playstation_ssl

backend b_netflix_playstation_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server playstation.nccp.netflix.com 1.2.3.4:9015

# netflix:nrdp ------------------------------------------------------------------------
# Some non-SNI-capable players use this domain, that's why this backend needs its own IP address.

frontend f_netflix_nrdp
  log global
  option httplog
  bind 192.168.0.116:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_nrdp

backend b_netflix_nrdp
  log global
  option httplog
  mode http
  server nrdp.nccp.netflix.com 1.2.3.4:8016

frontend f_netflix_nrdp_ssl
  log global
  option tcplog
  bind 192.168.0.116:443
  mode tcp
  default_backend b_netflix_nrdp_ssl

backend b_netflix_nrdp_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server nrdp.nccp.netflix.com 1.2.3.4:9016
  
# netflix:android  ------------------------------------------------------------------------
# Android uses this domain but some devices don't support SNI. That's why this backend needs its own IP address.
# You could try to add it to the SNI catchall (80/443) list if you don't have enough IP addresses.

frontend f_netflix_android
  log global
  option httplog
  bind 192.168.0.117:80
  mode http
  capture request  header Host len 50
  capture request  header User-Agent len 150
  default_backend b_netflix_android

backend b_netflix_android
  log global
  option httplog
  mode http
  server android.nccp.netflix.com 1.2.3.4:8017

frontend f_netflix_android_ssl
  log global
  option tcplog
  bind 192.168.0.117:443
  mode tcp
  default_backend b_netflix_android_ssl

backend b_netflix_android_ssl
  log global
  option tcplog
  no option accept-invalid-http-response
  mode tcp
  server android.nccp.netflix.com 1.2.3.4:9017

# deadend  ------------------------------------------------------------------------

backend b_sni_deadend
  mode http
  log global
  option httplog

backend b_deadend_ssl
  mode tcp
  log global
  option tcplog
  no option accept-invalid-http-response
  no option http-server-close