Messages

Thank you, that solves it!

(I have to admit that I even saw this PR, but didn't realize from the problem description that it fits to my issue.)

Hello!

I used the Caddy plugin with its layer 4 functionality solely to forward incoming HTTP and HTTPS requests depending on the server name, without terminating TLS. This worked great from early 2025 until May of this year, when - after apparently some browser updates - it stopped working. Since then I've just used the "catch all" TLS forwarding instead of TLS (SNI).

The error seems very similar to the one described in the post https://forum.opnsense.org/index.php?topic=42955.0 , which was resolved then. (And it worked well for me until May.)

More precisely, I see the following behavior:
- When I use curl for the request it works. (That is, the request gets forwarded correctly and I get an answer without any error.)
- When `security.tls.enable_kyber` is deactivated in Firefox, it works also.
- With the default settings of Firefox and Chromium my sites don't load but an SSL error is displayed, and I get log entries in Caddy like this:
    "debug","ts":"2026-09-06T13:21:22Z","logger":"caddy.listeners.layer4","msg":"matching","remote":"123.123.123.123:34567","error":"consumed all prefetched bytes","matcher":"layer4.matchers.tls","matched":false}

I currently use OPNsense 26.7.3_11 (but the described behavior started before the update to 26) and the caddy plugin 2.2.1 (Caddy 2.11.4, caddy-l4 0.1.2).

Thanks
Eric