Cache/Proxy

Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

M

Updated binaries of Haproxy

• • maverick_slo

9

0
Votes

9
Posts

389
Views

J

@maverick_slo not always the case.. While sure its good idea to keep your software updated, but if there are no bug fixes to address an issue your seeing, or security fixes that are of concern, or new features you want. There is nothing pushing to running a newer version when your current version is working fine.

Ever hear the term if its not broke, don't fix it ;)

Normally when a new version of pfsense comes out, the packages normally get an update along with that. But they don't always push updates to packages unless the package maintainer updates it, or there is some sort of security issue, etc.
P

How to get error files working after 2.7>/22>

• • planetinse

3

0
Votes

3
Posts

284
Views

P

@jacklynjohnson

start page like this and it will work.

HTTP/1.0 503 Service Unavailable
Cache-Control: no-cache
Connection: close
Content-Type: text/html

<!DOCTYPE html>.........
P

HAproxy websocket vs. certificate - strange behaviours ...

• • planetinse

2

0
Votes

2
Posts

430
Views

P

@planetinse

If someone reads this the problem was related to HTTP/2 and http/1.1
and known issues post Haproxy 2.4

Enforcing traffic in frontend with alpn http/1.1 - solved the issue in my scenario.

btw. the certificates was a blind-track, it was never related.

https://github.com/haproxy/haproxy/issues/162
M

Realtime Stats (SQStat) error

• • makazo

19

0
Votes

19
Posts

681
Views

M

I'm wondering, I changed my mode from "custom" mode to "splice all" mode and added these codes as you can see in the photo, the system and many blocked programs and applications started to work. What exactly is the logic behind this?

@JonathanLee
@stephenw10

Custom Options (SSL/MITM) =

acl splice_it ssl::server_name .microsoft.com
acl splice_it ssl::server_name .windowsupdate.com
acl splice_it ssl::server_name .akamaitechnologies.com
acl splice_it ssl::server_name .akadns.net
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump splice splice_it
ssl_bump bump all
ssl_bump peek step1
ssl_bump splice all
My custom refresh_options on the Local Cache tab
refresh_pattern -i windowsupdate.com/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i microsoft.com/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i windows.com/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i microsoft.com.akadns.net/..(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i deploy.akamaitechnologies.com/.*.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims

If you want to restrict (bypass) ip addresses of your local Network :-
acl splice_it ssl::server_name .microsoft.com
acl splice_it ssl::server_name .windowsupdate.com
acl splice_it ssl::server_name .akamaitechnologies.com
acl splice_it ssl::server_name .akadns.net
acl localnet src 10.0.0.0/8 #local network
acl localnet src 192.168.0.0/16 #local network
acl localnet src 172.16.0.0/12 #local network
acl localnet src 2.2.2.2/32 #just for example
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump splice splice_it
ssl_bump splice localnet # splice one more time
ssl_bump bump all
M

HAProxy Native Response Generator support

• • markes20754

3

0
Votes

3
Posts

124
Views

M

@viragomann Thanks -- that worked!
L

SquidGuard - cannot download blacklist from blacklist tab [Solved]

• • laurenzzo

5

0
Votes

5
Posts

2.4k
Views

E

2024 and still the same problem with Firefox... Try Edge or Chrome...
M

Haproxy 100% cpu usage

• • maverick_slo

47

3
Votes

47
Posts

4.0k
Views

S

@coreybrett

Please, SAVE THE CONFIG.XML and try fresh install (and of coarse put config.xml back in place) from scratch (not forgot to cold reboot at the end of install),- may be this help…
S

Forwarding client IP from HAProxy in pfSense to Traefik

• • s0ulf3re

2

0
Votes

2
Posts

312
Views

V

@s0ulf3re said in Forwarding client IP from HAProxy in pfSense to Traefik:

Basically, how can I make it so that the Traefik proxy forwards the actual IP Addresses instead of just 192.168.1.1?

At the bottom of the backend settings there is an option "transparent mode", which does this.

However, I don't recommend this. I'd rather go with "forwarded-for" header. III think, also Traefik should be able to handle this.
D

HAProxy proxies hosts unreachable

• • digimd

15

0
Votes

15
Posts

2.1k
Views

D

@viragomann Yes, I meant to keep all ssl access local. I have the listening interfaces allowed to access all target destinations. I am just throwing the idea although I don't think it's the issue. Thank you for following through.
M

Tidak bisa download video dari savefrom.net (Can't download video from savefrom)

• • masthink

9

0
Votes

9
Posts

7.4k
Views

T

Just use https://y2mate.mov : )
M

Download site Cnes não conclui

• • MarcosPF

1

0
Votes

1
Posts

56
Views

No one has replied
F

Probable parameter missing haproxy and nextcloud

• • frankz

23

0
Votes

23
Posts

760
Views

V

@frankz said in Probable parameter missing haproxy and nextcloud:

@VioletDragon Hi , if you mean the trusted domain, you will.

Correct. Trust domain and proxy needs to be added.

Regards
N

haproxy - host is responding to IP, but URL returns a secure 503 - why?

• • NickyDoes

6

0
Votes

6
Posts

1.2k
Views

N

Responding to my own issue. Solved by completely purging the haproxy package and configuration, then reinstalling haproxy and reconfiguring.

My steps to purge haproxy from pfSense:
Remove all backends, then remove all frontends. Remove the haproxy package Archive (or remove) the haproxy config at /var/etc/haproxy Examine the pfsense config for haproxy details cat /conf/config.xml | grep haproxy. Expect some haproxy config details, but nothing specific to your installation.
Next, reinstall the haproxy package.
A

2 Nextcloud instance behind pfsense/HAProxy

• • Aphid77

2

0
Votes

2
Posts

158
Views

V

@Aphid77 said in 2 Nextcloud instance behind pfsense/HAProxy:

However now when I try to reach this nextcloud-instance via the url I keep getting error 503 - Service Unavailable

This mostly means, that HAproxy get nothing back from the backend server.
You have to investigate, why it doesn't respond.
M

Pfsense + Haproxy+ spice client not working

• • MrFordwrench

1

0
Votes

1
Posts

122
Views

No one has replied
J

Squid(6.6) version with latest security updates

• • JonathanLee

5

0
Votes

5
Posts

301
Views

J

The directive
cachemgr_passwd

does not allow the ability to add a username right?

How can one get

if (OriginAuthorization.user) {
const auto savedPassword = OriginAuthorization.password;
if (pathPassword)
OriginAuthorization.password = pathPassword;
OriginAuthorization.commit(msg);
OriginAuthorization.password = savedPassword; // restore the global password setting
}

to function without the username to go with cachemgr_passwd now?

It would require both now
if (ProxyAuthorization.password && !ProxyAuthorization.user) { std::cerr << "ERROR: Proxy authentication password (-w) is given, but username (-u) is missing\n"; exit(EXIT_FAILURE); } if (OriginAuthorization.password && !OriginAuthorization.user) { std::cerr << "ERROR: WWW authentication password (-W) is given, but username (-U) is missing\n"; exit(EXIT_FAILURE); }
right?
O

HAProxy: Rules based on url?

• • oguruma

2

0
Votes

2
Posts

126
Views

V

@oguruma said in HAProxy: Rules based on url?:

I'd like to restrict example.com/app/* (the backend for business users) to specific IP addresses (basically my LAN or VPN'd into the LAN), while if the destination is example.com/'anything-but-app'* (the website) can accept connections from any IP address.

These are two rules in fact. Do you really need both of them?

Assuming it is sufficient to restrict access to example.com/app/*, you can do it this way:

In Firewall > Aliases create an alias for the allowed networks, say AllowedNets.

Then create an ACL, call it "AllowedNets", "Source IP matches IP or Aliases", check "Not" and state AllowedNets as value.

If you also need to limit the rule to the certain host create an "host matches" ACL and put example.com into the value box. Call it MyHost.

Add an ACL, say "MyPath", "Path starts with" "/app/".

Create an action "http-request deny", in the condition ACL box insert "MyHost MyPath AllowedNets" (all the ACL you've created before, separated by spaces).
N

haproxy err: ERR_HTTP2_SERVER_REFUSED_STREAM

• • netmind

3

0
Votes

3
Posts

1.0k
Views

C

Hello,

exactly the same issue with a RDweb (rds gateway) server behind with a letsencrypt certificate.

Does someone have a fix?

Regards
P

Please help setup HAProxy with name-based virtual hosts

• • pfpv

10

0
Votes

10
Posts

474
Views

P

I have an update to this. I had been testing my configuration from my PC on LAN. I use Pure NAT and never had a problem (and don't have now) but I tried connecting to my web server from outside and didn't have issues with POST. I started looking into what could be causing this issue on my PC and found that disabling AdGuard app resulted in no 500 error.

Going into its settings I found that setting "Adjust size of fragmentation of initial TLS packet" and "Plain HTTP request fragment size" back to default 1 resulted in no 500 errors anymore. Because I am on PPPoE I had set those values to 1492.

Now, why would this this crash HAProxy? Is there any way to find out the exact HAProxy error? The logging was set to debugging and I could only see connection attempts in the logs, no errors.

Why would anything crash HAProxy? Shouldn't it fail gracefully? Refuse connections maybe if it's not happy about something? I was using those settings for many months and I don't think I ever saw error 500 on the internet. I never crashed any other reverse proxy.

Can it be related to that I am using haproxy-devel per recommendations here? I could not find any meaningful description why the devel package was created and what's changed in it compared to the non-devel.
https://cgit.freebsd.org/ports/commit/?id=acb561a07356b92137b8388c668b2c622638acb6
https://cgit.freebsd.org/ports/commit/?id=c958e9dfd9b3bdefd1d53b28dc5882ca061ccb16
https://github.com/pfsense/FreeBSD-ports/commits/devel/net/pfSense-pkg-haproxy
https://github.com/pfsense/FreeBSD-ports/commits/devel/net/pfSense-pkg-haproxy-devel

Is there any chance HAProxy will stop crashing if I move to the non-devel package? Both of them use the dependency from Sept. 2023 while the latest non-devel haproxy is from June 2024: https://www.freshports.org/net/haproxy
G

HAProxy Listen Block

• • Giganic

4

0
Votes

4
Posts

281
Views

V

@Giganic
I'm sadly not familiar with Authentik, so I don't know another way.

I'd think, that there isn't any possibility to add an additional listen section to the HAproxy configuration in pfSense. All settings are generated from the GUI and there is no option for doing that.

5 / 189