<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Michal,<div class=""><br class=""></div><div class="">Thank you for the answer.</div><div class=""><br class=""></div><div class="">I found a solution for this using local port forwarding. What I do now is that I monitor my individual tunnels to check if they are alive. When one is dead I just have to change the port forward to the next stunnel entry.</div><div class=""><br class=""></div><div class="">I use netcat to check the connection availability as follow:</div><div class=""><br class=""></div><div class="">nc -z -x 127.0.0.1:$STUNNEL_PORT1 -X connect $DISTANT_SERVER $PORT</div><div class=""><br class=""></div><div class="">Under OS X, since 10.10 port forwarding is managed with the pfctl utility (on other linux distro we can use iptables):</div><div class=""><br class=""></div><div class="">echo "rdr pass inet proto tcp from 127.0.0.1 to 127.0.0.1 port $FAILOVER_PORT -> 127.0.0.1 port $STUNNEL_PORT1" | pfctl -ef - >/dev/null 2>&1</div><div class=""><br class=""></div><div class="">In case $STUNNEL_PORT1 is down or doesn't provide Internet access, I just switch to $STUNNEL_PORT2 and push the port forwarding rule with that port entry.</div><div class=""><br class=""></div><div class="">I wrote a daemon that monitors all my stunnel ports and check if they have Internet access, my PAC RETURN rules remain the same (they use my $FAILOVER_PORT), I just shifted stunnel ports to another location and use port forwarding to reach the stunnel entries that are alive.</div><div class=""><br class=""></div><div class="">It's working great so far.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class=""><div class="">
<div style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: 2; widows: 2; margin: 0px; font-size: 11px; font-family: Cambria; color: rgb(36, 0, 169);" class=""><br class="Apple-interchange-newline">Thireus (<a href="mailto:thireus@gmail.com" class=""><span style="letter-spacing: 0px;" class="">thireus@gmail.com</span></a>), </div><div style="color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: 2; widows: 2; margin: 0px; font-size: 11px; font-family: Cambria;" class=""><div style="margin: 0px;" class=""><div style="margin: 0px;" class=""><div style="margin: 0px;" class=""><div style="margin: 0px;" class=""><span style="letter-spacing: 0px;" class="">IT Security Engineer Consultant.</span></div></div></div><div style="margin: 0px; color: rgb(54, 0, 254);" class=""><span style="text-decoration: underline; letter-spacing: 0px;" class=""><a href="http://blog.thireus.com/" class="">http://blog.thireus.com</a></span></div></div></div>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">Le 15 nov. 2015 à 19:58, Michal Trojnara <<a href="mailto:Michal.Trojnara@mirt.net" class="">Michal.Trojnara@mirt.net</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><fieldset style="padding-top:10px; border:0px; border: 3px solid #CCC; padding-left: 20px;" class=""><legend style="font-weight:bold" class="">Signé partie PGP</legend><div style="padding-left:3px;" class="">On 15.11.2015 11:58, Thireus wrote:<br class="">> 1. I would like to know if there is a way to use failover with two<br class="">> servers with two different set of TLS cert/key.<br class=""><br class="">No.<span class="Apple-converted-space"> </span> Both client and server certificates are currently set way before<br class="">stunnel connects the target.<br class=""><br class="">I guess what you really need is client certificate selection based on<br class="">the list of acceptable issuers sent by the stunnel server, because<br class="">each of your stunnel servers expects client certificates issued by a<br class="">separate CA.<span class="Apple-converted-space"> </span> Am I right?<br class=""><br class="">Client certificate autoselection currently works on Windows with the<br class="">CAPI engine.<span class="Apple-converted-space"> </span> I have also added a new TODO item to implement client<br class="">certificate autoselection for certificates/keys stored in PEM files:<br class=""><a href="https://www.stunnel.org/sdf_todo.html" class="">https://www.stunnel.org/sdf_todo.html</a><br class=""><br class="">Alternatively, you may reconfigure your stunnel servers to accept<br class="">client certificates issued by the same CA.<br class=""><br class="">> 2. On the same topic, I would like to know if there is an option<br class="">> that could open the local port (accept) only when the connection<br class="">> (connect) is established?<br class=""><br class="">No.<br class=""><br class="">> The problem I'm facing is that I use a PAC profile with failover on<br class="">> several stunnel entries: "return PROXY 127.0.0.1:4441; PROXY<br class="">> 127.0.0.1:4442; PROXY 127.0.0.1:4443;".<br class=""><br class="">Did you mean:<br class="">return "PROXY 127.0.0.1:4441; PROXY 127.0.0.1:4442; PROXY 127.0.0.1:4443<br class="">";<br class="">?<br class=""><br class="">You are trying establish end-to-end failover across two (in fact<br class="">three, including connection between the stunnel server and the HTTP<br class="">proxy) separate TCP connections.<span class="Apple-converted-space"> </span> It is not possible without a<br class="">heartbeat service.<br class=""><br class="">> 3. Is there another way to tweak stunnel behavior when a remote<br class="">> server is down?<br class=""><br class="">You could write a heartbeat service to periodically initiate short<br class="">connections to the remote services, and then reconfigure stunnel<br class="">accordingly.<span class="Apple-converted-space"> </span> Still, this is a crude workaround and not the proper<br class="">solution.<br class=""><br class="">Best regards,<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Mike</div></fieldset><br class="">_______________________________________________<br class="">stunnel-users mailing list<br class=""><a href="mailto:stunnel-users@stunnel.org" class="">stunnel-users@stunnel.org</a><br class="">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users<br class=""></div></blockquote></div><br class=""></div></body></html>