From: Mischa <openbsd@mlst.nl>
Subject: Re: relayd: support multiple resolveble addresses
To: tech@openbsd.org, rafael@sizeofvoid.org
Date: Sat, 02 May 2026 14:23:09 +0200

Hi Kirill,

I tried the patch and when using "tls keypair" it doesn't like it.
Snippet of the config I used:

###
local_v4="46.23.xx.xx"
local_v6="2a03:6000:xx.::x"
table <localhost> { 127.0.0.1 }

http protocol httpsfilter {
         tcp { nodelay, sack }
         tls keypair example.com
         tls { ciphers 
"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:AES-256-GCM-SHA384", 
ecdhe "default", no client-renegotiation }
}
relay default_tls {
         listen on $local_v4 port 443 tls
         listen on $local_v6 port 443 tls
         protocol httpsfilter
         forward to <localhost> port 443
}
###

Mischa

On 2026-05-02 13:43, Kirill A. Korinsky wrote:
> On Sat, 02 May 2026 11:16:13 +0200,
> Chris Narkiewicz <hello@ezaquarii.com> wrote:
>> 
>> On Mon, Apr 06, 2026 at 11:33:21AM +0200, Kirill A. Korinsky wrote:
>> > Here I changed parser to create a dedicated listener for each discovered
>> > and confiugred on a local inerface address.
>> 
>> Update to /etc/examples/relayd.conf would be nice touch.
>> 
> 
> What is actually good sugestion. I not sure how to make it, but the 
> most
> natural way is something like that:
> 
> Index: etc/examples/relayd.conf
> ===================================================================
> RCS file: /home/cvs/src/etc/examples/relayd.conf,v
> diff -u -p -r1.6 relayd.conf
> --- etc/examples/relayd.conf	29 Oct 2023 11:27:11 -0000	1.6
> +++ etc/examples/relayd.conf	2 May 2026 11:41:39 -0000
> @@ -2,7 +2,6 @@
>  #
>  # Macros
>  #
> -ext_addr="192.168.1.1"
>  webhost1="10.0.0.1"
>  webhost2="10.0.0.2"
>  sshhost1="10.0.0.3"
> @@ -24,7 +23,7 @@ table <fallback> { 127.0.0.1 }
>  # Services will be mapped to a rdr rule.
>  #
>  redirect www {
> -	listen on $ext_addr port http interface trunk0
> +	listen on egress port http
> 
>  	# tag every packet that goes thru the rdr rule with RELAYD
>  	pftag RELAYD
> @@ -51,7 +50,7 @@ http protocol https {
> 
>  relay wwwtls {
>  	# Run as a TLS accelerator
> -	listen on $ext_addr port 443 tls
> +	listen on egress port https tls
>  	protocol https
> 
>  	# Forward to hosts in the webhosts table using a src/dst hash
> @@ -69,7 +68,7 @@ protocol sshtcp {
> 
>  relay sshgw {
>  	# Run as a simple TCP relay
> -	listen on $ext_addr port 2222
> +	listen on egress port 2222
>  	protocol sshtcp
> 
>  	# Forward to the shared carp(4) address of an internal gateway