我也遇到类似问题。我是在 homelab 上起了 haproxy 来转发。根据 rdp ssh ssl http 分流，http 类分流后再识别下 host 。vnc 似乎没有什么特别的流量特征，只好做默认转发了。
```plain
#######################
# 全局配置
#######################
global
log stdout format raw local0 debug
# SSL 配置
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
#######################
# 默认配置
#######################
defaults
log global
option httplog
timeout connect 5000
timeout client 50000
timeout server 50000
#######################
# TCP 四层入口
#######################
frontend main
mode tcp
bind *:10001
option tcplog
tcp-request inspect-delay 3s
# 协议识别规则
acl is_ssl req.payload(0,1) -m bin 16 # SSLv3/TLS
acl is_ssl req.payload(0,3) -m bin 160301 # TLS 1.0
acl is_ssl req.payload(0,3) -m bin 160303 # TLS 1.2
# HTTP 识别
acl is_http req.payload(0,3) -m bin 474554 504f53 505554 44454c 4f5054 484541 434f4e 545241
acl is_ssh req.payload(0,3) -m bin 535348
acl is_rdp req.payload(0,3) -m bin 030000
# 流量分发规则
tcp-request content accept if is_ssl || is_http || is_ssh || is_rdp
use_backend http-forward if is_http
use_backend ssh if is_ssh
use_backend rdp if is_rdp
use_backend ssl-backend if is_ssl
default_backend vnc
#######################
# SSL 处理
#######################
backend ssl-backend
mode tcp
server ssl-server 127.0.0.1:10003
frontend ssl-frontend
mode http
bind *:10003 ssl crt /etc/ssl/
example.com/ssl.pem option tcplog # 改用 tcplog
# 基于 SNI 的路由规则，外部还是访问 10001 端口，故 host 端口写 10001
acl host_claude hdr(host) -i
claude.example.com:10001 acl host_copilot hdr(host) -i
copilot.example.com:10001 acl host_alist hdr(host) -i
alist.example.com:10001 acl host_read hdr(host) -i
read.example.com:10001 use_backend claude if host_claude
use_backend copilot if host_copilot
use_backend alist if host_alist
use_backend readeck if host_read
#######################
# HTTP 处理
#######################
backend http-forward
mode http
server http-frontend 127.0.0.1:10002
frontend http-frontend
mode http
bind *:10002 # 使用一个新的端口
# 添加全局重定向到 HTTPS
redirect scheme https code 301 if !{ ssl_fc }
option httplog
option dontlognull
option forwardfor
acl host_copilot hdr(host) -i
copilot.example.com:10001 acl host_alist hdr(host) -i
example.com:10001 acl host_claude hdr(host) -i
claude.example.com:10001 acl host_read hdr(host) -i
read.example.com:10001 use_backend copilot if host_copilot
use_backend alist if host_alist
use_backend claude if host_claude
use_backend readeck if host_read
#######################
# 后端服务配置
#######################
backend ssh
mode tcp
server ssh 192.168.1.201:22662
backend rdp
mode tcp
server rdp 192.168.1.210:10002
backend vnc
mode tcp
timeout server 1h
server vnc 192.168.1.201:5902
backend copilot
mode http
server copilot copilot:8181 check
backend alist
mode http
server alist alist:5244 check
backend claude
mode http
server claude Fuclaude:18181 check
backend readeck
mode http
server readeck readeck:8000 check
backend http-default
mode http
server default 127.0.0.1:80
```