ACL explainer and tester

Paste acl lines and the rules that use them (http-request, tcp-request, use_backend, default_backend). Each line is explained, and the tester runs a request through them the way HAProxy does. Everything stays in your browser.

Config lines

What each line does

Test request

Method

Scheme

Host

Path and query

Client IP (src)

SNI (empty = host)

Other headers (Name: value, one per line)

Result

ACL	Result	Why

Rules in the order HAProxy runs them

What the tester understands

Fetches: src, dst_port, method, path, url, query, base, hdr(name) / req.hdr, fhdr, hdr_cnt, cook(name), urlp(name), req.ver, ssl_fc, ssl_fc_sni, ssl_fc_has_sni, req.ssl_sni, req.ssl_hello_type, var(txn.x), and the short forms path_beg, hdr_end(host), url_sub, path_reg, hdr_dom, path_dir… Predefined ACLs such as TRUE, METH_GET, HTTP_1.1, LOCALHOST.

Matching: -m str|beg|end|sub|reg|dom|dir|len|found|bool|int|ip, -i, integer operators eq ge gt le lt and ranges 10:20, IPv4/IPv6 CIDR. Several acl lines with the same name are OR-ed.

Converters: lower, upper, field, word, length, host_only, port_only, regsub, url_dec, bytes, strcmp. map* converters and -f file are explained but give "unknown" in the tester.

Rules: conditions with if/unless, !, ||/or and inline { … } ACLs. tcp-request then http-request rules run first (deny, tarpit, redirect, return, auth, allow, set-var, set-header, del-header, set-path); then the first matching use_backend, else default_backend. Stick-table counters (sc_http_req_rate) and server state (nbsrv) are unknown to the tester.