OpenWRT issue with /etc/sslh.conf

[tleepa]

Hi,

I have sslh, version 2.1.2 (I know, quite old, but it is latest available) running on my GL-MT6000 (arm) router.

My /etc/config/sslh:

package 'sslh'

config 'sslh' 'default'
        option enable '1'
        option configfile '/etc/sslh.conf'

My /etc/sslh.conf:

foreground: false;
inetd: false;
numeric: true;
transparent: false;
timeout: 2;
on-timeout: "timeout";
user: "nobody";
pidfile: "/var/run/sslh.pid";
chroot: "/var/empty";

listen:
(
    { host: "<REDACTED external DDNS domain>"; port: "443"; }
);

protocols:
(
    { name: "ssh"; host: "192.168.199.199"; port: "22"; fork: true; transparent: true; },
    { name: "openvpn"; host: "192.168.199.199"; port: "1194"; transparent: true; },
    { name: "tls"; host: "hostB.home"; port:"9443"; sni_hostnames: [ "hostB.<REDACTED>" ]; log_level: 0; },
    { name: "tls"; host: "hostA.home"; port:"5001"; sni_hostnames: [ "hostA.<REDACTED>" ]; log_level: 0; },
    { name: "timeout"; host: "1.2.3.4"; port: "1234"; }
);

Problem is, tls parts do not work, when I try connecting to e.g. https://hostA., I can see this:

❯ sslh -f -F /etc/sslh.conf --verbose-connections=3 --verbose-connections-try=3 --verbose-connections-error=3 --verbose-probe-info=3 --verbose-probe-error=3
Landlock: Failed to create a ruleset
probing for ssh
probed for ssh: PROBE_NEXT
probing for openvpn
probed for openvpn: PROBE_NEXT
probing for tls
probed for tls: PROBE_AGAIN
probing for tls
probed for tls: PROBE_AGAIN
probing for tls
probed for tls: PROBE_AGAIN
probing for timeout
probed for timeout: PROBE_MATCH
trying to connect to 1.2.3.4:1234 family 2 len 16

but when I run it like this, it works:

❯ sslh -f --verbose-connections=3 --verbose-connections-try=3 --verbose-connections-error=3 --verbose-probe-info=3 --verbose-probe-error=3 --listen=<REDACTED>:443 --ssh=192.168.199.199:22 --openvpn=192.168.199.199:1194 --tls=hostA.home:5001
Landlock: Failed to create a rulesetprobing for ssh
probed for ssh: PROBE_NEXT
probing for tls
probed for tls: PROBE_AGAIN
probing for openvpn
probed for openvpn: PROBE_NEXT
probing for ssh
probed for ssh: PROBE_NEXT
probing for tls
probed for tls: PROBE_AGAIN
probing for openvpn
probed for openvpn: PROBE_NEXT
probing for ssh
probed for ssh: PROBE_NEXT
probing for tls
probed for tls: PROBE_MATCH
trying to connect to hostA.home:5001 family 2 len 16
tls:connection from user-46-112-90-48.play-internet.pl:40505 to <REDACTED>:https forwarded from rtr.home:43404 to hostA.home:5001

but this method does not allow me to specify sni_hostnames or different transparency settings per protocol.

Additional remarks:

• this setup was working fine before, I think before upgraded to OpenWRT 25.12

• I built myself sslh version 2.3.1, which behaves in the exact same way

• regardless of the config method and sslh version, ssh and openvpn work fine

• running sslh with /etc/sslh.conf does work if I set my Firefox browser to use TLS v1.2 max (it is set to v1.3 by default):

  Landlock: Failed to create a ruleset
  probing for ssh
  probed for ssh: PROBE_NEXT
  probing for openvpn
  probed for openvpn: PROBE_NEXT
  probing for tls
  matching [hostA.REDACTED>] with [hostB.REDACTED>]
  probed for tls: PROBE_NEXT
  probing for tls
  matching [hostA.REDACTED>] with [hostA.REDACTED>]
  probed for tls: PROBE_MATCH
  trying to connect to 192.168.9.19:5001 family 2 len 16

• I have seen v2.3.1 showing SNI in the packet hexdump, I could also see it with v2.1.2 after dumping the traffic

• I could live without sni_hostnames checks, as I plan to have caddy as a single target for any tls/http traffic, but I would really need ssh and openvpn use transparent mode (tls and http may not, although I am considering using libproxyprotocol)

Is there anything you can advise?