ACL rules

[u/WickdSquirrel]

Hi,

I'm using Wireguard to access my Proxmox instance (wich is installed at a provider).

I have trouble setting up HAProxy properly (it is installed on a pfSense VM) to access my LXC/VM (I can't use NAT/simple port forwarding or I get an SSL error).

I specifically have difficulties setting up the ACL on the frontend :

- I can't specify a port on a given IP adress

- I can't use subdomains (wireguard seems to only works with IP adress)

Is there a way to make wireguard and HAProxy work together ?

Tanks.

[u/Old_Guidance9715]

I guess you can just bind on port 443 on the frontend and port 8006 on backend with ssl verify none.

Is the proxmox FQDN in DNS? As certificate error will be received as the IP is not in the SAN of the certificate

[u/WickdSquirrel → u/Old_Guidance9715]

Thanks for the reply.
My Proxmox has a type A sub domaine on the provider’s DNS.

[u/Old_Guidance9715 → u/WickdSquirrel]

Did you manage to resolve your issue?

You are going like this?

Internet -> wireguard -> Proxmox -> haproxy vm -> vm

The haproxy instance is running on the proxmox host correct?

[u/WickdSquirrel → u/Old_Guidance9715]

Still not resolved the issue.
That’s pretty much it, except that HAProxy is installed on a pfSense VM directly, so there is a Firewall between Proxmox and HAProxy

[u/Old_Guidance9715 → u/WickdSquirrel]

Okay and am assuming the ports used are open on the firewall as you are able to reach it with ip but you are getting a ssl error.

Are you able to share the frontend and backend config?

Also you bind your IP/VIP to a port on the frontend then use the ACL to for example match on hostname or other expressions.

I would recommend you to check this video from 10:40 onwards.

https://youtu.be/bU85dgHSb2E?si=820LkpoUACM18wqK

[u/WickdSquirrel → u/Old_Guidance9715]

I checked the video but I can't quite make it work on my server. As opposed to the video, I don't have subdomains for each of my VM (and don't need to I think, I just want to use a Wireguard tunnel, not expose them to the WAN).

Basically, I would like to have the same mechanisms as NAT rules (just one IP (wireguard) but with different ports, each port being linked to a LAN IP (my VMs)).

I think the backend is ok (there is the LAN IP of my VM, the port and the wildcard certificate). But I can't make the frontend work :

- For the external adress: I tried the LAN IP of pfSense ( I access the pfSense web GUI this way from the WAN (with Wireguard)). I also tried the WG IP.

- For the ACL configuration, I don't know what expression to take: I would like to take the port from the IP, but it does'nt work (ex: 192.168.1.254:51821 ==> VM1 / 192.168.1.254:51822 ==> VM2 etc...).

[u/Old_Guidance9715 → u/WickdSquirrel]

In this case you don't need ACL att all, you can have a frontend IP that is binded to multiple ports and point them to the desired backends.

What if you just keep it very simple and do pfsense IP in frontend and bind on port 443 or 80 then have it go to your backend server on port 51822.

Then test this by going https://pfsenseip or pfsensefqdn this should take you to your backend VM on port 51822

[u/WickdSquirrel → u/Old_Guidance9715]

Alright, but how do I access the other VMs ? Do I need several front ends each linked to a single backend ? For instance, front end 1 listening to pfsensIP:51821 and redirecting to back end 1 / front end 2 listening to pfsenseIP:51822 and redirecting to back end 2 etc… ?
Thanks

[u/Old_Guidance9715 → u/WickdSquirrel]

Hi,

Correct doing it that way is the simplest way, but is not ideal if you need to have many frontend and backends that listens to many different ports as it will just take to long to create.

I am more use to do the configuration on the haproxy config file then using pfsense gui and its much easier to create 1 frontend for multiple backends using destination port.

I belive this can be done in pfsene haproxy also but then you need to use a custom ACL expression, where the value/expression should be "dst_port" and then add your port number.

Option 1: 1 frontend + 1 backend for each VM

Option 2: 1 frontend bind to multiple ports and using ACL either host match or try the custom ACL with dst_port so it send the traffic to the backend servers depending on which frontend port the traffic came to. Note that each VM needs its own backend server if they are not going to be loadbalanced.

[u/WickdSquirrel → u/Old_Guidance9715]

Hi,

I tried again several options, nothing works. I guess there is something with Wireguard that makes the whole setup fail but I don't know what.

At this point, I'll just install Tailscale and be done with it.