Hi there,

We have a load-balancer setup, in which an HTTPS Request flows through the following steps:-

Client -> DNS -> stunnel on Load-Balancer -> HAProxy on LB -> Web-Server

This setup works perfectly when stunnel is listening to the local IP of the Load-Balancer.

However in our setup we have 2 load-balancers and we want to be able to listen to a virtual IP, which only ever exists on one LB at a time (keepalived flips the IP to the second LB if the first one falls over).

HAProxy has no problem in doing this (and I can ping the assigned virtual IP on the load-balancer I'm testing), but it seems stunnel hates the concept.

Has anyone achieved this before (below is my stunnel config - as you can see I'm actually listening for ALL traffic on 443):-

cert= /etc/ssl/certs/mycert.crt
key = /etc/ssl/certs/mykey.key
;setuid = nobody
;setgid = nogroup

pid = /etc/stunnel/stunnel.pid
debug = 3
output = /etc/stunnel/stunnel.log

socket=l:TCP_NODELAY=1
socket=r:TCP_NODELAY=1

[https]
accept=443
connect=127.0.0.1:8443
TIMEOUTclose=0
xforwardedfor=yes

Sorry for the long-winded question!