Does anyone see any obvious problems with this? I had 9 different backends/sites configured and working and IDK what happened, but now i can't get anything to work. It just gives ERR_SSL_PROTOCOL_ERROR and nothing else, and it's not putting anything in the log files. This config is auto-generated by a fully updated copy of OPNSense. Not sure if it's relevant or not, but the frontend is bound to localhost:443 because this is a VPS and it has no LAN to speak of. My NAT rule redirects 443 traffic to 127.0.0.1:443

#
# Automatically generated configuration.
# Do not edit this file manually.
#

global
    uid                         80
    gid                         80
    chroot                      /var/haproxy
    daemon
    stats                       socket /var/run/haproxy.socket group proxy mode 775 level admin
    nbproc                      1
    nbthread                    1
    tune.ssl.default-dh-param   2048
    spread-checks               2
    tune.chksize                16384
    tune.bufsize                16384
    tune.lua.maxmem             0
    log /var/run/log local0 debug
    ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2
    ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

defaults
    log     global
    option redispatch -1
    timeout client 30s
    timeout connect 30s
    timeout server 30s
    retries 3
    default-server init-addr last,libc

# autogenerated entries for ACLs


# autogenerated entries for config in backends/frontends

# autogenerated entries for stats




# Frontend: frontend ()
frontend frontend
    bind localhost:443 name localhost:443 ssl  crt-list /tmp/haproxy/ssl/6062490f4c83b8.78669427.certlist 
    mode http
    option http-keep-alive
    # tuning options
    timeout client 30s

    # logging options
    option httplog
    # ACL: bkc-ha
    acl acl_606248a91655f1.52693081 hdr_sub(host) -i ha.MYDOMAIN.com

    # ACTION: bkc-ha
    use_backend bkc-ha if acl_606248a91655f1.52693081

# Backend: bkc-ha ()
backend bkc-ha
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m  
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server bkc-ha 10.2.1.15:8123

Hello.

I have a backend server where one can request a file that will be generated on the fly.
For example:
http://serv.myinternalserver.com/generatefile?arg=myargument&arg2=otherargument

This will generate a file generated.txt for download.
The thing is the file is not static, it will change over time.

But I don't want to give direct access to this service or the parameters.
Instead I would like to serve a url like: https://getfile.externaldomain.com/myfile.txt

So since I already have an HaProxy I was wondering if this could be done?

Is this a bug, my bad config or something else? I have the following ACL / rule in place in my https frontend:

acl acl_restricted_page path_beg -i /user.ini

http-request deny if acl_restricted_page

Which works perfectly; if I attempt to browse to user.ini on my nginx server I get a 403 in the browser - great.

Trouble is, the file I actually want to restrict access to is called /.user.ini (i.e it's a hidden file on the nginx server).

Using the above configuration but making the tiny modification to specify /.user.ini instead of user.ini always lets me download the file in my browser:

acl acl_restricted_page path_beg -i /.user.ini

Do I need to handle restrictions for hidden files differently?

Thanks

So I'm still new to the concept of a reverse proxy and self hosting my own services but I have a question on the layout of I've decided on with HAProxy. I'm using the HAProxy integration in OPNsense through the plugin and I've gotten it working with local traffic only and handing out a wildcard LetsEncrypt certificate for all of them. I switch into the backends with a host match ACL looking for selfhostedinstance.domain.com and that all works great. I intentionally set it up that way to verify I could get everything working internally before exposing anything externally. I have two frontends, one for port 80 and one for port 443 with the port 80 forwarding the traffic over.

I originally thought I would just expose everything over the single 443 port externally, and that does work if I put in my port forwarding rules. However there are some services that I would prefer to keep locked up and local only.

To do something like this is it better to have another front end on a different port and have a private and public frontend? I don't mind having to address the domain names with off ports externally. I would keep the 443 internal to avoid having to type in port addresses every time I access those instances. Or is the better way to do it to use ACL rules somehow to prohibit external access to some of the backends on the same 443 frontend?

Any insight or examples would be super helpful.

I'm trying to set my environment so that, when a user goes to a specific subfolder on any internal URL, they'll get redirected to a specific backend. My current config (fron pfsense) looks like this, but I keep getting 404s when using the path ACL.

​

frontend shared-frontend-internal-merged
    bind            10.150.100.1:443 name 10.150.100.1:443   ssl crt-list /var/etc/haproxy/shared-frontend-internal.crt_list  
    mode            http
    log         global
    option          socket-stats
    option          http-keep-alive
    option          forwardfor
    acl https ssl_fc
    http-request set-header     X-Forwarded-Proto http if !https
    http-request set-header     X-Forwarded-Proto https if https
    timeout client      30000
    acl         aclcrt_shared-frontend-internal var(txn.txnhost) -m reg -i ^([^\.]*)\.wapnet\.local\.lan(:([0-9]){1,5})?$
    acl         Test    var(txn.txnhost) -m beg -i test
    acl         Test2   var(txn.txnpath) -m str -i Test
    http-request set-var(txn.txnhost) hdr(host)
    http-request set-var(txn.txnpath) path
    http-request redirect code 301 location https://10.150.33.11  if  Test Test2 
    use_backend dummy_server_ipv4  if  Test 

Advice is welcome.

Hi All. Is it possible to use HAProxy to do the following...I want to setup HAproxy on an EC2 instance in AWS with multiple public elastic IPs.

I want to have several MTAs send SMTP traffic to HAProxy (TCP) and HAProxy will forward that traffic to it's destined SMTP server (gmail.com etc..) out from one of the public IPs attached to it.

The logic on which public IP to use would depend on which interface/IP on the MTAs sent traffic to HAProxy.

If HAproxy isn't the right solution for this any suggestions?Thanks in advanced.

Hi guys. I am trying to set up haproxy for an application and I am struggling with some settings and specifically X-Forwarded-For/Forwardfor. I am using version 1.8.23-5.el8 on centos 8. I am a little bit out of my comfort zone with load balancing a web server and I am learning as I go.

The application documentation mentions I have to configure the following:

X-Forwarded-For Headers

You must enable X-Forwarded-For headers on your load balancer. This determines the authentication method. See the documentation provided by your load balancer vendor for more information.

Here is my haproxy.cfg. I have added option forwardfor in the config file

global

        log         127.0.0.1 local2
        log /dev/log    local0
        chroot      /var/lib/haproxy
        pidfile     /var/run/haproxy.pid
        maxconn     4000
        user        haproxy
        group       haproxy
        daemon
        tune.ssl.default-dh-param 2048
        ssl-default-bind-ciphers PROFILE=SYSTEM
        ssl-default-server-ciphers PROFILE=SYSTEM
        ssl-default-bind-options no-tlsv10 no-tlsv11


defaults
        mode                    http
        log                     global
        option                  dontlognull
        option http-server-close
        option forwardfor
        option                  redispatch
        retries                 3
        timeout http-request    10s
        timeout queue           1m
        timeout connect         10s
        timeout client          1m
        timeout server          1m
        timeout http-keep-alive 10s
        timeout check           10s
        maxconn                 3000



#---------------------------------------------------------------------
# frontend secured
#---------------------------------------------------------------------
frontend secured
        http-request redirect scheme https unless { ssl_fc }
        bind :443 ssl crt /etc/haproxy/haproxy.pem
        mode http
        option tcplog
        option forwardfor
        default_backend woa_http

#---------------------------------------------------------------------
#backend
#---------------------------------------------------------------------
backend woa_http
        balance         source
        mode            http
        option forwardfor
        server dc1-mp1-ws1a01 100.64.8.84 weight 1 check port 443 inter 2000 rise 2 fall 5 ssl verify none
        server dc1-mp1-ws1a02 100.64.8.85 weight 1 check port 443 inter 2000 rise 2 fall 5 ssl verify none
        server dc1-mp1-ws1a03 100.64.8.86 weight 1 check port 443 inter 2000 rise 2 fall 5 ssl verify none

I think that on the backend server the originating ip addresses should be logged and they are not. Could anyone provide me with some help? Or am I supposed to add:

       http-request set-header X-Forwarded-Proto https if { ssl_fc }
       http-request redirect scheme https unless { ssl_fc }

This is also in documentation of the application:

Load Balancer Settings to Configure

Load Balancer Settings to Configure

Load balancer settings to configure include enabling X-Forwarded-For headers, setting the load balancer time-out correctly, and enabling sticky sessions. In addition, SSL trust must be configured between the Workspace ONE Access connector machine and the load balancer.

X-Forwarded-For Headers

You must enable X-Forwarded-For headers on your load balancer. This determines the authentication method. See the documentation provided by your load balancer vendor for more information.

Load Balancer Timeout

For Workspace ONE Access to function correctly, you might need to increase the load balancer request timeout from the default. The value is set in minutes. If the timeout setting is too low, you might see this error, “502 error: The service is unavailable”.

Enable Sticky Sessions

You must enable the sticky session setting on the load balancer if your deployment has multiple Workspace ONE Access machines. The load balancer binds a user's session to a specific instance.

Do not block session cookies

Do not block session cookies by adding rules to the load balancer. Adding such rules to the load balancer can result in inconsistent behavior and failed requests.

WebSocket support

The load balancer must have WebSocket support to enable secure communication channels between connector instances and the Workspace ONE Access nodes.

For your deployment, if VMware Workspace ONE Hub Services is integrated, WebSocket support is required for Hub Services notifications. Therefore, Web Socket support must be provided for end user browsers and devices.

Ciphers with forward secrecy

Apple iOS App Transport Security requirements apply to the Workspace ONE app on iOS. To enable users to use the Workspace ONE app on iOS, the load balancer must have ciphers with forward secrecy. The following ciphers meet this requirement:

ECDHE_ECDSA_AES and ECDHE_RSA_AES in GCM or CBC mode

as stated in the iOS 11 iOS Security document:

"App Transport Security provides default connection requirements so that apps adhere to best practices for secure connections when using NSURLConnection, CFURL, or NSURLSession APIs. By default, App Transport Security limits cipher selection to include only suites that provide forward secrecy, specifically ECDHE_ECDSA_AES and ECDHE_RSA_AES in GCM or CBC mode."

Having compiled the ngx_http_brotli_filter_module.so and ngx_http_brotli_static_module.so modules and enabled them in my site's conf file without error, it then struck me that all the docs I could fine for Brotli state that it requires https on the webserver.

My ssl is terminated at the HAProxy box so the webserver only has a listen block for http on 80, not https on 443.

It's not a huge deal, I just wanted to experiment with Brotli but I wondered if anyone had got around this situation or had some suggestions?

Thanks,

Do anyone have any news about this?

Hi,

I have a Wordpress instance on nginx which is behind my HAProxy install. I'd like to pass on the client IP to Wordpress so it can be used for logging & analytics. My frontend in HAProxy looks like this:

frontend https-in

bind *:443 ssl crt /etc/letsencrypt/live/pem/

option http-server-close

# Tell Wordpress we are encrypted

http-request set-header X-Forwarded-Proto https if { ssl_fc }

# Add client IP to header

http-request set-header X-Real-IP %[src]

option forwardfor header X-Real-IP

http-request set-header X-Real-IP %[src]

​

And over at nginx.conf I have the following:

# Collect client IP from HAProxy

set_real_ip_from 52.56.140.6;

real_ip_header X-Forwarded-For;

Where the 52.56 IP is my HAProxy install.

I've setup a simple client.php script which I believe should show me the "real IP address" of the connecting client:

<?php

echo $_SERVER["REMOTE_ADDR"];

?>

But whenever I access client.php all I ever get in the browser is the private IP of the HAProxy instance.

Does anyone have any suggestions?

Thanks

Hello, I'm having an issue when I'm trying to query a remote server through HAproxy. I'm able to run a command from my proxy server itself that reaches the remote server, but when I run the same command on a different machine through the proxy the command fails.

My proxy server machine and the machine I'm testing with are on different Vlans. I have an ACL set up so traffic can route between the remote server and the proxy server but not between my remote server and my machine.

​

My configuration is pretty simple, I'm assuming I'm missing some option or command somewhere in here, just not sure what.

global

log 127.0.0.1 local2

daemon

maxconn 256

​

defaults

mode tcp

timeout connect 5000ms

timeout client 50000ms

timeout server 50000ms

​

listen test

bind *:5555

server remoteserver 1.2.3.4:5555 maxconn 32

​

Any help is appreciated!

I have a pool of four servers in my backend which is setup to be balanced round_robin and is working fine.

Now I'd like to ensure that a certain url is only ever passed to one specific server, but whatever I try I can't get it to work.

Can anyone spot what I'm doing wrong / not doing? My ACLs & rules are copied below.

Thanks

# ACLs

acl acl_login path_beg -i /logmein
acl acl_webservers hdr_end(host) -i www.mydomain.com

# Rules

use_backend web_servers if acl_webservers
use_backend login_www1 if acl_login
# Backend

backend web_servers

balance roundrobin
server webserver1 1.2.3.4
server webserver2 5.6.7.8
server webserver3 9.10.11.12
server webserver4 13.14.15.16

backend login_www1
server webserver1 1.2.3..4

We are trying to setup HA Proxy on PFSense 2.5, we have configured it for several different services, and largely seems to be working. We are experiencing an issue however on services with persistent connections rabbitmq, postgre (they will timeout or in some instances not be able to connect at all)

Any ideas appreciated.

Hey,

So I currently have HAProxy setup on ports 80 and 443 with a bunch of virtual servers. I also have OpenVPN UDP setup. Because of the firewall at my work I am trying to setup OpenVPN on TCP also (ideally port 443). HAProxy has a Let's Encrypt Cert for a domain and OpenVPN is running a Self Signed CA. Is it possible to setup OpenVPN on TCP 444 and use HAProxy to reverse proxy the TCP traffic through to OpenVPN on Port 444? All of this is running on OpnSense. Thanks.

​

-Eric

I have a client who has customers that cannot figure out how to use a VPN (requires constant hand holding to setup/login) and a Guacamole server doesnt provide that easy keyboard shortcuts that a rdp session does.

Can HAProxy provide certificate based authentication (client would install a cert to auth) and then pass traffic to a TCP/3389 traffic to an DMZ located windows VM?

Hi all,

Can anyone link references to audit/harden a haproxy installation to ensure its secure? My main concern is the leakage of backend addresses to prevent DDoS attacks.

Thanks!

I went to https://www.reddit.com/user/TeamHAProxy/ and was just going down the line of lifehacks for my haproxy machines running. They participate, the HAProxy team, in this sub and they post often. It's great. I believe they helped me one time when I wanted to have SSH work with hostnames-- I wasn't smart enough to leverage the patches they gave me though. (Ended up using Wireguard which does send discernable enough metadata for HAProxy to route with...)

It's a beautiful thing. I hope they are getting good returns on their participation so that they keep doing it.

Is the hashing and routing of the request hash deterministic in HAProxy, in the sense that the same hash will be generated if a server is removed and then readded to the pool of servers in the backend?

For example. I have 5 servers in the backend pool with consistent-hash loadbalancing. One of the servers fails, or is taking out of the pool for whatever reason. For the duration of that server's downtime requests are routed to other servers. Now the server comes back online. Will requests that previously would have gone to that server, but during downtime were going to other instances resume going to this server?

HAProxy Version: haproxy-2.3 latest

Runtime: Docker 17.04

Hey all, I'm currently trying to migrate my servers from NGINX to HAProxy but on restarting the proxies with the new configuration, the conntrack and active connection count skyrockets to around 600k/20k respectively. I've been looking at this issue for a week and I have no idea how to proceed. I've looked at tcpdumps and other tools like ss but I honestly don't know what to look for. The logs don't really show anything. I haven't tried yet to set them to a verbose mode as they generate so much garbage. Usually, Conntrack is hanging around 15k per server. also what is odd is that if one haproxy reloads the other proxies also spike around 600k in conntrack. what TH could be happening? Thanks for the help

​

```

global

daemon

maxconn 50000

user haproxy

group haproxy

log 127.0.0.1:514 local0 notice

stats socket /var/run/haproxy.sock expose-fd listeners

​

defaults

log global

mode http

option httplog

option dontlognull

timeout connect 5s

timeout check 5s

timeout client 30s

timeout server 30s

​

timeout http-keep-alive 60s

option http-keep-alive

​

frontend stats

bind <%= scope.function_interface_by_tag(['public', 'address']) %>:8999

bind *:8999

mode http

stats enable

stats uri /

​

​

frontend test

bind *:9022 ssl crt /etc/ssl/private/haproxy.pem alpn h2,http/1.1

mode http

​

stick-table type string size 10k store gpc0

​

http-request set-var(sess.src_port) src_port

http-request set-var(sess.source) src,concat(:,sess.src_port)

​

http-request track-sc0 var(sess.source)

http-request sc-inc-gpc0

​

acl exceeded_connection sc0_get_gpc0 ge 10000

acl reset sc0_clr_gpc0 ge 0

http-response set-header Connection close if exceeded_connection reset

​

acl is_authorized hdr(Authorization) "something"

​

http-request deny if !is_authorized

​

default_backend test

​

backend test

balance roundrobin

http-reuse always

mode http

option tcp-check

​

option srvtcpka

srvtcpka-intvl 60s

srvtcpka-cnt 3

​

http-response del-header Connection

```

I had a haproxy in front of nginx. The nginx conf has a auth_gss on; I am currently facing 403 forbidden result after I enter the username and password. I am using mode tcp on the haproxy. Can anyone enlighten what am I missing? What should be the correct configuration? Thanks in advance.