lately I had to set up multiple a haproxy frontend for one of our WAN IPs which has multiple backends - one for each customer.

Some customers require us to access the backend from any WAN IP, some others from specific subnets. Since a Firewall-Rule on the same port (eg. 443) for our WAN IP can either be from any IP source or a specific one, I decided to setup it the following way:

• Each frontend has multiple acls for each URL and also for each customer subnet, if required.

• If multiple networks have to access an URL, an extra acl with source ip defined is setup up also

• All other requests not matching an URL and an IP get dropped

Now the pfsense acl syntax usually not requires an AND-operator, however, when having multiple urls and subnets, the acl syntax gets more  complex.
Haproxy offers a way of grouping OR-requirements using (). So instead of using

acl_url1 acl_ip1 || acl_url1 acl_ip2 || acl_url2 acl_ip1 etc.

I could do:

(acl_url1 || acl url2 ) (acl_ip1 || acl_ip2) etc.

The acl fiels is a one-line small input field in the UI, making it difficult to read so I have to stick to a text editor and copy-paste it afterwards.
Also the ()-syntax is denied by the pfsense-gui when applying the haproxy.cfg by saying "unknown acl …".

I strongly suggest this to be changed so acls can be set up more easily and being kept compact like they used to be when working with a normal haproxy configuration created by hand. Also I would like to request the field to be made resizable or (at least) having a scroll-function.

• Julian