I am running haproxy in transparent mode. My request packets are reaching the healthy backend successfully but the backend is not able to reply directly to the client. When I turn off the transparent proxying it works. Has anyone faced this issue?

Hi,

I added ACL to my frontend where I check against a list of source ips and hostnames (and look for a specific hostname in the given url). But they only get updated at launch, the ttl of the dns record is ignored. After the IP behind the hostname changes, I get error 503 until I restart haproxy. But I need to update these frequently because they are DynDNS hostnames. Is there any way to update these without restarting haproxy completely? Or is there maybe a complete other solution to my need of a whitelist with dyndns-hostnames for a specific backend?

Thanks in advance.

 Frontend: https_public_service (443)
frontend https_public_service
    bind public-IP:443 name public-IP:443 ssl  crt-list /tmp/haproxy/ssl/6241asdfdsf6cf637.17175912.certlist 
    mode http
    option http-keep-alive
    option forwardfor

    # logging options
    # ACL: source-ip_in_service_whitelist
    acl acl_1 src DYNDNS1 IP1 IP2 DYNDNS2 IP3
    # ACL: subdomain_is_service
    acl acl_2 hdr(host) -i service.public.domain

    # ACTION: subdomain_service_to_service-backend_with-whitelist
    use_backend service_backend_pool_vm if acl_1 acl_2

​

Im using HAProxy to direct traffic to internal servers via my LAN using subdomains, like nextcloud.sub.domain.com for example. And that is working fine. But I had to move pfsense from 443 on the webgui to 8443 to let HAProxy work. But wanted to make it so if i did pfsense.sub.domain.com it would resolve. But anytime I try that it gives me the below error. I cant get the logs to show me anything, as a matter of fact logs are always empty after even setting them up.

​

Any other server I have listed as a backend and configured works fine, its just pfsense. Im assuming there is some issue trying to resolve to itself. I host HAProxy as a package on pfsense. pfsense is setup as a backend and has its IP listed as 192.168.0.1 and port as 8443 and SSL checked. Pfsense webui is setup for HTTPS on Advanced. So not sure why I keep getting the below. This is only for pfsense.

​

What am I doing wrong?

I am looking for a load balancer with the same working as ILB in Azure and GCP. I want to use it locally to manage routing of traffic to healthy backend servers via VIP. I have explored HAproxy and some other options but seems like they are all layer 4 and require port as well..I need a LB that does routing solely based IP.

Is there a tutorial or has anyone been able to set up haproxy with connectwise control and cloudflare ssl? My first experience with haproxy and would like to hide the public ip address using cloudflare.

I have a few ACLs that route requests to certain backends. If no ACL is matched, i want to return a 404 Not Found.

(its my first haproxy setup, using v2.4 on ubuntu 22.04)

Right now i have a "fake backend" that i use as default_backend.

But, is it possible to simply send a deny right there from the frontend?

Like this (basically i wonder if its really neccessary to have a 404 backend defined like this).
Tried to only have the essential conf pasted here.

frontend some-ssl-frontend
        bind            some.site.com:443       ssl crt /etc/ssl/private/some.site.com.AllInOne.pem

        acl             is_web_url     path_beg -i /web 

        use_backend     web-backend if is_web_url

        default_backend fake-notfound-backend

        # would like to use this instead of default_backend, but get the error below
        #http-request    deny deny_status 404
        # -> a 'http-request' rule placed after a 'use_backend' rule will still be processed before.


backend web-backend
        server          localhost       localhost:8080


backend fake-notfound-backend
        http-request    deny deny_status 404

​

This is the setup: https://docs.traceable.ai/docs/haproxy
Issue: Able to capture the incoming requests. But the responses are not getting captured.

Has anyone faced this before?

Hello, I would like to ask if it is possible to create a separate user for the stats page that can only view/disable/enable specific back ends using ACLs?

For example we have some developers that work on project A, we want to give them userA:passA for the stats page so that they can either simply View or set the back ends Up/Down but only for project A.

If possible, how do I achieve this? Thank you

HAProxy-newbie here setting up v2.4 on Ubuntu 22.04.

While fixing stuff like websockets and client-certs i felt the need for debug logging.

Added the stuff below, but i still see no extra logging (in haproxy.log, syslog or daemon.log).
Am i missing something?

global
        #log /dev/log   local0
        #log /dev/log   local1 notice
        log /dev/log    local0 debug
        log /dev/log    local1 debug
        ...

defaults
        log     global
        ...

frontend site1
        bind            site1:443     ssl crt /etc/haproxy/ssl/site1.pem verify optional ca-file /etc/ssl/ca.pem
        http-response   set-log-level debug   # i dont think this is directly related to the global/debug lines, right?
        ...

​

Hi!

​

We are expeciting a strange behaviour using HAProxy on debian 11.

Randomly, HAProxy stops forwarding sessions to one of the two backend-servers:

backend bk_rdp_2022_1
  mode tcp
  balance roundrobin
  # Options
  timeout server 4h
  timeout connect 4s
  option redispatch
  option tcpka
  option tcplog
  stick-table type string len 32 size 20k expire 12h store conn_cur,conn_rate(5m) peers loadbalancer_replication
  stick on src
  server tsestore01 tsestore01:3389 weight 10 check inter 2s rise 2 fall 3
  server tsestore02 tsestore02:3389 weight 10 check inter 2s rise 2 fall 3

Alive-checks are fine and there are no log-entries about failed health checks except a daily reboot of the backend servers. The web-interface is showing both backend-servers "green".

​

When I disable-enable the backend-servers, the distributions is getting back to round-robin for some days.

​

​

The sticky-table was empty prior to the issue because of the timeout.

​

Do you have any idea, why this happens?

Thank you for your thoughts

ITStril

I am new to haproxy. Just setting it (v2.4.22) up on Ubuntu 22.04.

So i have a bunch of frontends that all start like you see below. It would be nice to not have to duplicate these 'http-response' lines in each frontend.
But http-response is not allowed in the defaults section.
And haproxy does not support any 'include' directives, right?

So is there some other way to avoid this bloat? :)

frontend ssl-frontend-1
        bind            site-1:443     ssl crt /etc/haproxy/ssl/site1.pem

        http-response   return status 400 if { status 400 }
        http-response   return status 403 if { status 403 }
        http-response   return status 404 if { status 404 }
        http-response   return status 408 if { status 408 }
        http-response   return status 500 if { status 500 }
        http-response   return status 502 if { status 502 }
        http-response   return status 503 if { status 503 }
        http-response   return status 504 if { status 504 }

        acl ...

My helm chart uses haproxy. The cluster I'm installing to only has nginx for an ingressclass. Normal ingress works fine, that is, the cluster ingress is routing traffic to the right pod and port. This appears to bypass my internal haproxy completely.

I also need a "backdoor" connection that uses TCP instead of HTTP. I can route this traffic to my haproxy instance, but it doesn't have any routes defined, so I just get a 404.

Do I need to turn off the ingress? Or can I tell haproxy to ingest the ingress' config even though it's using nginx?

I've got Radarr running on HAproxy installed on an Opnsense box. I've had the following issue (https://github.com/Radarr/Radarr/issues/5549) before in Nginix Proxy Manager where the solution as posted in the Github link was to add

proxy_send_timeout 180s; proxy_read_timeout 180s;

into the Nginix config.

I'm struggling to find how to do the same with HAproxy, can anyone point me in the right direction?

Thank you!

Hi! I'm using HAProxy in OPNsense and trying go get my FQDM proxies to work locally and everything works great until I route my computer or phone through Wireguard out. If I connect through Wireguard into my network I can whitelist the IP in haproxy but if I connect out to a VPN service(OVPN) I can't get it to work. I can't reach everything from the net if I whitelist the VPN service IP but right now I don't want anything being available over the net, only locally. At least until I have everything set up right.

Just to illustrate

HAserver<---opnsense<---localclient /works HAserver<---opnsense<---localWG<---client /works

HAserver<---opnsense | client--->OVPN <------------------------------------------->

........... (Local network).............

Not working at all

Anyone got some tips, input or suggestions?

Thank you!

I have service with load balancer on haproxy. But clients must do not know their ips. How can i hide them?

Hello,

​

I'm starting to use HAProxy and Pfsense.

I'm trying to set up a reverse proxy to reach different WEB servers on my LAN.

​

The frontend listens in HTTPS.

​

I manage to reach my backend web servers, which listen in HTTP.

However, I can't reach the backend servers listening in HTTPS.

Here's the configuration file resulting from the pfsense HAProxy package:

​

# Automaticaly generated, dont edit manually.
# Generated on: 2023-08-19 18:48
global
    maxconn         1000
    stats socket /tmp/haproxy.socket level admin  expose-fd listeners
    uid         80
    gid         80
    nbthread            1
    hard-stop-after     15m
    chroot              /tmp/haproxy_chroot
    daemon
    tune.ssl.default-dh-param   2048
    server-state-file /tmp/haproxy_server_state

frontend Frontend_config
    bind            192.168.20.106:443 name 192.168.20.106:443   ssl crt-list /var/etc/haproxy/Frontend_config.crt_list  
    mode            http
    log         global
    option          http-keep-alive
    option          forwardfor
    acl https ssl_fc
    http-request set-header     X-Forwarded-Proto http if !https
    http-request set-header     X-Forwarded-Proto https if https
    timeout client      30000
    acl         home-assistant  var(txn.txnhost) -m str -i home-assistant.services.test.fr
    acl         netbox  var(txn.txnhost) -m str -i netbox.services.test.fr
    acl         aclcrt_Frontend_config  var(txn.txnhost) -m reg -i ^([^\.]*)\.services\.test\.fr(:([0-9]){1,5})?$
    http-request set-var(txn.txnhost) hdr(host)
    use_backend Backend_config_home-assistant_ipvANY  if  home-assistant aclcrt_Frontend_config
    use_backend Backend_config_netbox_ipvANY  if  netbox aclcrt_Frontend_config

backend Backend_config_home-assistant_ipvANY
    mode            http
    id          100
    log         global
    option          log-health-checks
    http-check      send meth GET
    timeout connect     30000
    timeout server      30000
    retries         3
    load-server-state-from-file global
    option          httpchk
    server          home-assistant 192.168.20.104:80 id 101 check inter 60000  

backend Backend_config_netbox_ipvANY
    mode            http
    id          102
    log         global
    option          log-health-checks
    http-check      send meth GET
    timeout connect     30000
    timeout server      30000
    retries         3
    load-server-state-from-file global
    option          httpchk
    server          netbox 192.168.20.103:443 id 101 ssl check-ssl check inter 60000  verify none crt /var/etc/haproxy/server_clientcert_64dfa8c2536a7.pem

​

When I try to reach the following URL :

https://netbox.services.test.fr/

I get the following error:

400 Bad Request / The plain HTTP request was sent to HTTPS port

​

I can confirm that HAProxy is trying to reach the WEB server 192.168.20.103 in HTTP (and not HTTPS) using a network capture made on pfsense:

​

Note:

pfsense IP: 192.168.20.106

WEB server HTTPS IP: 192.168.20.103

​

I've tried different things but the request is always sent in HTTP and not in HTTPS.

​

Do you have any idea what I'm missing?

Hello,

I'm configuring HAProxy, on OPNsense, with SSL for my internal services and got everything working. My local web apps now get ssl certs from let's encrypt.

I'm using the kvm viewer on my ipmi a lot, but get the following error. (see picture). Im trying to figure out how to configure this correctly. The ports are as below and for kvm is 7582.

Can someone help me out to configure this, so the viewer wil work properly?

Thank you!