# tls + proxy\_protocol How to set HTTP/2 ALPN? **URL:** \ **Category:** Questions / Help\ **Created:** [March 26, 2022, 2:30am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495 "2022-03-26T02:30:39Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [March 26, 2022, 2:30am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/1 "2022-03-26T02:30:39Z")
Hi I’m using tls offloading with `proxy_protocol` and it’s great (I see the corrent client IP), but I still can’t get a HTTP/2 connection negotiated in any way (including HTTP2 prior knowledge). It seems that there is no way to set TLS ALPN to be `h2`, it’s always `http/1.1`. Is there any way to tell the fly app to advertise HTTP2 support on a specific port. ```auto # This is my networking section [[services]] internal_port = 8080 protocol = "tcp" [[services.ports]] handlers = ["tls", "proxy_proto"] port = "443" ``` Server hello examples (note it’s not `h2`): ![image](https://global.discourse-cdn.com/fly1/original/3X/b/9/b90538c344ceb72cd7370c3ceb3c70d3e3ff8a56.png) ![image](https://global.discourse-cdn.com/fly1/original/3X/6/d/6d40338a06cde32f927f220a7baa687370e13c9e.png) ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [March 26, 2022, 2:43am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/2 "2022-03-26T02:43:54Z")
Nevermind, found it Here [GitHub - fly-apps/grpc-service: Running gRPC services on Fly.io](https://github.com/fly-apps/grpc-service#whats-happening-inside) And here > [@Fly Proxy H/2 Details](https://community.fly.io/t/fly-proxy-h-2-details/4449/2): > > It’s definitely not passthrough if you have the http handler. If you want to pass through http/2, you can enable only the tls handler and use the following port definition: [[services.ports]] handlers = ["tls"] port = "443" tls\_options = { alpn = ["h2", "http/1.1"] } Or just h2 in the list of alpn. Then your app will need to understand http/2 over plaintext. ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [March 26, 2022, 4:17pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/3 "2022-03-26T16:17:47Z")
Nice! What kind of app are you building? ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [March 26, 2022, 4:35pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/4 "2022-03-26T16:35:36Z")
A .NET 6 gRPC app. Wrote my own connection middleware to process proxy protocol header. It seems that fly is only using plain text PROXY V1, so it could been a bit simpler. Currently having issues with connection processing where Kestrel complaints about `h2/h2c` and `http/https` scheme mismatch, since it’s not aware about TLS offload (endpoint is HTTP2 only). And also it’s not possible to process both h2c and http/1.1 on same port. ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [March 26, 2022, 9:02pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/5 "2022-03-26T21:02:15Z")
It seems that Kestrel [needs to know](https://github.com/dotnet/aspnetcore/blob/c85baf8db0c72ae8e68643029d514b2e737c9fae/src/Servers/Kestrel/Core/src/Internal/HttpConnection.cs#L197) the `ALPN` to choose the correct protocol. I can force it to be `h2`, but it will break if client used `http/1.1`. Probably can hack it to detect HTTP2 client preface as in RFC7540 If [fly.io](http://fly.io) supported PROXY V2 then it would be possible to use [`PP2_TYPE_ALPN`](https://www.haproxy.org/download/2.6/doc/proxy-protocol.txt) ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [March 29, 2022, 12:56am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/6 "2022-03-29T00:56:42Z")
Will consult with the team and get back to you 😄 Sounds reasonable. ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [March 29, 2022, 2:25pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/7 "2022-03-29T14:25:44Z")
Nice! For now I managed to make it work with the client preface hack. Now I’m figuring out the how to use OpenTelemetry stuff for metrics (on a isolated endpoint without proxy protocol) ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [April 5, 2022, 9:39am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/8 "2022-04-05T09:39:45Z")
You can find my current middleware here. > **[GitHub - nazar554/Scintillating.ProxyProtocol.Middleware: ASP.NET Core...](https://github.com/nazar554/Scintillating.ProxyProtocol.Middleware)** > > ASP.NET Core middleware for accepting connections with PROXY protocol header. - nazar554/Scintillating.ProxyProtocol.Middleware ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [April 16, 2022, 11:05pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/9 "2022-04-16T23:05:17Z")
Wait a second: Is Fly’s `proxy_proto` handler `v1` only? If so, it shouldn’t support for IPv6 (which I think it does)? ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [April 17, 2022, 12:04am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/10 "2022-04-17T00:04:04Z")
No, IPv6 works correctly with even with proxy V1, see the example [here](https://www.haproxy.org/download/2.6/doc/proxy-protocol.txt) ```auto - TCP/IPv6 : "PROXY TCP6 ffff:f...f:ffff ffff:f...f:ffff 65535 65535\r\n" => 5 + 1 + 4 + 1 + 39 + 1 + 39 + 1 + 5 + 1 + 5 + 2 = 104 chars ``` ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [April 22, 2022, 10:10am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/11 "2022-04-22T10:10:45Z")
^ Thanks. * * * @jerome et al any timeline for support for `proxy_proto` v2? The `ClientHello` contents (specifically, ALPN and SNI) sent in v2 is helpful for our use-case. ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [May 5, 2022, 9:32am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/12 "2022-05-05T09:32:25Z")
Any update on supporting `PROXY v2`? Our middleware (request router) needs to peek at TLS `ClientHello`, too. ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 12, 2022, 3:41pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/13 "2022-05-12T15:41:48Z")
Update: We have a working branch for proxy proto v2. I’m going to test it out a bit before letting you in on it. ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 19, 2022, 8:48pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/14 "2022-05-19T20:48:48Z")
Update: This is now available. If you use something like this for your port handler, it should work: ```nohighlight [[services.ports]] handlers = ["proxy_proto"] port = "5000" proxy_proto_options = { version = "v2" } ``` ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [May 21, 2022, 11:20am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/15 "2022-05-21T11:20:40Z")
I can confirm I receive the PP2\_TYPE\_ALPN but no PP2\_TYPE\_SSL. I guess I’ll have to change the code to assume that receiving **either** of these means the connection is using TLS. ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [May 21, 2022, 11:27am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/16 "2022-05-21T11:27:10Z")
We can fix that ---
**Author:** ![nazar554](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/nazar554/32/43353_2.png) [@nazar554](https://community.fly.io/u/nazar554)\ **Post date:** [June 13, 2022, 10:54am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/17 "2022-06-13T10:54:16Z")
Did you change something in PROXY V2 support? My app started crashing with a 0x14 TLV (length is 0x3B = 59 bytes), see the `14 00 3b` sequence in hexdump I think when you tried adding PP2\_TYPE\_SSL you used the wrong TLV value in decimal, since 0x14 HEX = 20 DEC, but it’s [defined as hexadecimal](https://www.haproxy.org/download/2.6/doc/proxy-protocol.txt) ` #define PP2_TYPE_SSL 0x20` ```auto 00000000 0d 0a 0d 0a 00 0d 0a 51 55 49 54 0a 21 11 00 70 .......Q UIT.!..p 00000010 2e 76 78 d1 6d 69 d8 8e 05 40 01 bb 01 00 02 68 .vx.mi.. .@.....h 00000020 32 02 00 1e 73 61 72 64 61 75 6b 61 72 2d 64 31 2...sard aukar-d1 00000030 36 65 65 63 37 38 31 62 34 31 2e 66 6c 79 2e 64 6eec781b 41.fly.d 00000040 65 76 14 00 3b 01 00 00 00 01 15 00 07 54 4c 53 ev..;... .....TLS 00000050 76 31 2e 33 19 00 05 45 43 44 53 41 18 00 06 53 v1.3...E CDSA...S 00000060 48 41 32 35 36 17 00 18 54 4c 53 31 33 5f 41 45 HA256... TLS13_AE 00000070 53 5f 31 32 38 5f 47 43 4d 5f 53 48 41 32 35 36 S_128_GC M_SHA256 ``` ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [June 13, 2022, 11:02am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/18 "2022-06-13T11:02:49Z")
Yes we did add the SSL TLV. It might be slightly wrong. We can take a look in about 2 hours. Until then I recommend switching the v2 option off if it’s not too much trouble. (If it’s crashing your app) ---
**Author:** ![amos](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/amos/32/2036_2.png) [@amos](https://community.fly.io/u/amos)\ **Post date:** [June 13, 2022, 11:05am UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/19 "2022-06-13T11:05:32Z")
Yeah, we added SSL and Authority TLVs last week: [https://poppy-rust.fly.dev/](https://poppy-rust.fly.dev/) The 0x20/20 mixup seems like a bug in a crate we’re using: [model.rs - source](https://docs.rs/ppp/2.1.0/src/ppp/v2/model.rs.html#153) Fairly easy to work around, unfortunately I’m off today. However, I wanted to recommend making sure your app doesn’t crash on unrecognized TLVs - the spec may evolve later and new TLVs might be added, it’s relatively straightforward to skip over them since they’re prefixed by type+length. ---
**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\ **Post date:** [June 13, 2022, 12:46pm UTC](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495/20 "2022-06-13T12:46:38Z")
@nazar554 we deployed a fix for this. It should now have the correct value. [Next page](https://community.fly.io/t/tls-proxy-protocol-how-to-set-http-2-alpn/4495.md?page=2)