@veldthui Deleting the backend would prevent the rule from being applied when rules get loaded again.. Maybe reloading rules is not triggered when applying settings for a disabled haproxy.. You could 'force' a reload of the rules from the status/filterreload page (if i remember the name of that menu correctly).. That would load the new ruleset without haproxy adding its rules at that time if the backend was deleted.. As for 'needing' transparent client ip.. to get traffic going its not needed. if you want make rules based on the client-ip on the server, then it might be required if proxy-protocol and http-headers are out of the question.. It does come with these disadvantages though that it needs to be in the reply path, and will 'block' other direct requests... It might be possible to open a second port or adding a second private IP on the webserver for the purpose of haproxy connecting to it with client-ip's thus 'avoiding' blocking the regular direct traffic and your nat-portforward..

@2fst4u said in HAProxy client certificate validation per app: What extra settings does the development package provide? The development package allows specifying client certificate options per shared-frontend by using the crt-list option of haproxy 1.8 with a specific sslbindconf for each sni where 1.7 does not support that and thus hides those options in the webgui. b.t.w. that the package is called -devel does not mean the software isn't stable.. The current development version of haproxy is '2.0-dev' and 1.9 is also marked stable.. though still as some rough edges... 1.8 is really stable for everything it supports.

thank you ! very good the video, the more I believe that my error is in the frontends, I created a standard frontend, and then I was creating new frontends sharing the first one. I've done different now, I'm creating the ACLs and ACTIONS directly on the default frontend like the image below [image: 1555491780592-captura-de-tela-2019-04-17-a-s-06.01.04.png] [image: 1555491911057-captura-de-tela-2019-04-17-a-s-06.04.42.png] This has worked well for me.

@KOM I will wait for the purchase of the new Hardware and perform the system update. Thanks a lot for the help.

HAproxy is certainly the path there but you're going to want to get rid of all of those port forwards. HAproxy frontend listens on WAN address, looks at the connection details, and proxies to the appropriate backend servers. You don't have to port forward, you just open 80/443 so HAproxy can receive connections.

Thanks for the information. Seems about the same settings as it's on my PFsense. I'll give it a try with an additional webserver, might be that my OWA is messing up the mappings.

@treybeatty Can you define what 'stooped' means exactly? Error while starting haproxy? Haproxy starts and stats page works, but client traffic does not reach the (web)servers ? Any error message shown in the browser? Can you 'curl' to haproxy locally on the pfSense box itself? Does the stats page show the (web)servers as 'up' ?

@KOM Thanks your comments have been very useful !!! n.n/

Hello, how are you ! I'm having the problem that you, more in my case is the zimbra the console console uses port 7071 and webmail uses port 443 you can put the screens of your HA-proxy. Thank you so much

@stephenw10 I'm sorry for answering just now, had some family issues, but I solved the problem by cleaning the cache and restarting the desktop. I have no problem with any browser. Thanks for the thelp and attention!

Connnect to console via ssh and Shell (F8) Then just type: tcpdump -i <interface> -s 65535 -w <some-file> (where interface must by eth1 or vmx1 depending on your ethernet driver).

Ouch... Really sorry! I think I've made a mistake... I don't have Pfsense server anymore but i think that It was not External FQDN but reverse https default site witch cares... And I'm wondering if you don't have to use an host name and not a domains one, something like host.mydomain.com and not only a domain.com... But My certificate wasn't a wildcard. So it could be wrong. To be complete there's some points I have to add here: to get through this issue, I used the console to look at the squids configurations files. it's not so difficult and there can be found the ssl adresses usable to connect I ve never been able to have everything working as it should with PFsense with squid on it. One colleague of mine tried again with a fresh install of Pfsense to be sure theyre's no artefact of what I did. But for me, as I read it so many times, pfsense does not work fine with squid (we forgot Squid and changed to a commercial solution)

Thanks for posting your solution, whatever it is.

Commonly that's caused by Squid and clients resolving URLs to different IPs because they are using different DNS servers. https://docs.netgate.com/pfsense/en/latest/cache-proxy/squid-troubleshooting.html?highlight=squid#sites-not-loading-with-splice-error-409-in-access-log Steve

...turns out ACLs are processed in order, just like firewall rules. My bad! Just have to keep a wildcard ACL matching a redir action just like before but at the very end of the ACL list, no default backend needed. I'm so stupid!--no wonder why I kept noticing the little blue anchors next to each entry. ...is it anchor or anvil? 🤨 IDK anymore.

@periko I will answer my own post. Looks like I found the issuem, once we enable and setup bind, for some reason the file /etc/resolv.conf lost the line: nameserver 127.0.0.1 Them squid read this file and for some reason the queries fall. Now, I have 2 paths: Add manually the localhost in the resolv.conf file in the first line. Or add as alternative dns in squid localhost 127.0.0.1 Using any of this 2 options everything start working. Them bind have some daemon, because I select LAN+Localhost for listen. Hope some could check this which affect proxy transparent MITM. Thanks.