HostSNI cant connect with dbeaver

Traefik Traefik v2 (latest)
,
1

Hello guys,

K8s, Traefik 20.8

I have pgbouncer service like ClusterIP and i would like to connect to it with DBeaver.

I opened a 6432 port in my LoadBalancer to proxy connection from it to my pgbouncer port

entryPoints:
  pgbouncer:
    address: ':6433/tcp'
ports:
  pgbouncer:
    port: 6433 # where my pgbouncer working
    expose: true
    exposedPort: 6432 # where i want to connect 
    protocol: TCP

My Ingressroutetcp config

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: pgbouncer-ingressroute
spec:
  entryPoints:
      - pgbouncer
  routes:
  - match: HostSNI(`pgbouncer.uat.data.yac.rupn.mars-ad.net')
    services:
    - name: pgbouncer
      port: 6433
  tls:
    passthrough: true

I can see in dashboard that my router is made and it has status is OK with rule service etc.

Also

Test-NetConnection -ComputerName pgbouncer.uat.data.yac.rupn.mars-ad.net -Port 6432

ComputerName : pgbouncer.uat.data.yac.rupn.mars-ad
RemoteAddress : 10.240.132.99
RemotePort : 6432
InterfaceAlias : Ethernet 2
SourceAddress : 10.192.84.164
TcpTestSucceeded : True

nslookup passed okay for pgbouncer.uat.data.yac.rupn.mars-ad with IP what i need

nmap passed okay for pgbouncer.uat.data.yac.rupn.mars-ad with 6432 port open status

But when i am trying to connect with DBeaver host pgbouncer.uat.data.yac.rupn.mars-ad.net port 6432 i received Read timed out. I stuck on this already 1 week and cant understand what could be a problem.

PS i put pgbouncer.uat.data.yac.rupn.mars-ad cause i cant post more than 4 links in a post

I think I am missing something important but idk what.

Thanks a lot in advance!

2

Last time I checked(a while ago nowjust now) the postgres wire protocol does not complete a TLS handshake so HostSNI will not work.

In fact a SSLRequest is sent and the server will send a N or S in response.

To continue after S, perform an SSL startup handshake (not described here, part of the SSL specification) with the server

1 Like
3

If no TLS is used, you can only use HostSNI(`*`), which usually means you have to use a dedicated port per target service.

1 Like
4

Yeap, i changed to '*' and took out tls: passthrough: true and now everything working fine, thanks a lot for help:)

5

Yeap, thanks a lot, i fix it:)

6

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.