Egress proxy

Each server in a cluster reaches the internet from its own public address, which changes when the server is replaced. The servers reach the hostnames in the egress_proxy variable through the core server, whose Elastic IP stays the same for the life of the stack.

Stack variables

egress_proxy.hostnames

A list of hostnames that the servers in a cluster reach over HTTP on port 80 and HTTPS on port 443 through the core server. The stack creates an origin certificate for them that gets served by the core server. On other ports, connections to these hostnames from the servers also go to the core server. To forward these connections to the hostname, add an entry to egress_proxy.forwards for each port, with the hostname as the target_address.

egress_proxy.forwards

A list of TCP ports that the core server forwards. Each entry has a port, a target_address, and an optional target_port that defaults to port when not provided. The target_address is a hostname or an IPv4 address. The core server forwards each connection on the port to the target_address on the port (or target_port if provided).

When the target_address is a hostname, every connection to that hostname from the servers in a cluster goes to the core server. When the target_address is an IPv4 address, the servers connect to server.internal on the port. The stack opens the port on the core server only to the stack’s VPC.

The stack refuses the list when two entries have the same port or when an entry has a port that a core server may use. These ports are 22, 80, 111, 443, 2049, 3306, 4369, 5672, 6379, 6380, 9200, 9300, 25672, and 33060. Use target_port to get around that limitation.

Example:

{
  "variables": {
    "stacker_variables": {
      "egress_proxy": {
        "hostnames": ["api.example.com"],
        "forwards": [
          {
            "port": 2222,
            "target_address": "sftp.example.com",
            "target_port": 22
          }
        ]
      }
    }
  }
}

With this entry, the core server forwards port 2222 to sftp.example.com on port 22. The servers in a cluster connect to sftp.example.com on port 2222 to reach it.

Existing core servers

The stack passes its variables to a core server only when it creates the core server. On an existing core server, Webscale adds the egress_proxy variable to /etc/webscale/stacker.conf and runs sudo stacker. When the variable has hostnames, Webscale also adds the certificate and key that the stack created. When the variable changes, the core server keeps the connections that it already forwards. They stop when the core server or its egress proxy restarts.

Logs

The core server writes a line to /var/log/egress-proxy.log at the start and at the end of each connection that it forwards. The logs look like this:

2026/10/29 20:52:49 Connecting client=10.0.1.20:51234 target=sftp.example.com:22
2026/10/29 20:52:49 Closed client=10.0.1.20:51234 target=sftp.example.com:22 upstream=203.0.113.10 bytes_received=1053943 bytes_sent=5011 duration=229ms
2026/10/29 20:53:02 Connecting client=10.0.1.20:51236 target=sftp.example.com:22
2026/10/29 20:53:02 Failed client=10.0.1.20:51236 target=sftp.example.com:22 error="dial tcp 203.0.113.10:22: connect: connection refused"

Last modified on October 30, 2026