Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HAProxy Source IP Alias Problem [Solved]

    Scheduled Pinned Locked Moved
    Cache/Proxy
    9
    13
    5.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      PiBa
      last edited by

      Not missing a step.. just that haproxy isn't going to resolve the names in a list to IP's, so the 'alias support' is limited to fixed IP's and subnets a.t.m.. It could be possible i suppose to resolve a list of names to IP's by the package when reloading the config, but when a dns record changes it wouldn't take effect until the config is reloaded.. so really it would still be of limited use.

      1 Reply Last reply Reply Quote 0
      • J
        jafath
        last edited by

        Thanks PiBa.

        Is it possible to read the contents of a pfSense table from a shell script?  If so, I could simply run a cron job to read the table contents which is being resolved correctly and write the HAProxy src file which is being configured correctly, but not populated.

        1 Reply Last reply Reply Quote 0
        • P
          PiBa
          last edited by

          Your cron job would be to late if its going to edit the file as it is only read on haproxy startup..

          There might still be a possibility though, if you manage to read the ip's from pfSense.

          pfctl -t bogons -T show

          And then add them to the haproxy in memory list.

          /usr/local/pkg/haproxy/haproxy_socket.sh add acl /var/etc/haproxy/ipalias_infoddns.lst 1.2.3.4/31
          R 1 Reply Last reply Reply Quote 0
          • J
            jafath
            last edited by

            That works perfectly!  Thanks very much for your help.

            1 Reply Last reply Reply Quote 0
            • J
              jafath
              last edited by

              Here's the script I added to cron.  There might be more efficient / better ways to do it, but this works for my case with a fairly small number of IPs in the alias.

              #!/bin/sh

              Update an HAProxy acl with ddns addresses from a pfsense table

              #Edit this value to match pfSense alias name
              ALIASNAME="infoddns"

              #Force update on first run - acl will be empty after restart
              /usr/local/pkg/haproxy/haproxy_socket.sh show acl "/var/etc/haproxy/ipalias_${ALIASNAME}.lst" > "/tmp/${ALIASNAME}-acl"
              rc=wc -l < "/tmp/${ALIASNAME}-acl" | awk '{print $1}'
              if [ $rc -lt 2 ]; then echo "X" > "/tmp/${ALIASNAME}-cur"; fi

              #Dump the alias table to a temp file
              pfctl -t ${ALIASNAME} -T show > "/tmp/${ALIASNAME}-new"

              #Check new alias table against current
              diff "/tmp/${ALIASNAME}-new" "/tmp/${ALIASNAME}-cur" >/dev/null 2>&1

              #If no change, just exit
              rc=$?; if [ $rc == 0 ]; then exit 0; fi

              #Clear current acl
              /usr/local/pkg/haproxy/haproxy_socket.sh clear acl "/var/etc/haproxy/ipalias_${ALIASNAME}.lst"

              #read each alias table line and add to HAproxy acl IP values
              while read -r line; do
              /usr/local/pkg/haproxy/haproxy_socket.sh add acl "/var/etc/haproxy/ipalias_${ALIASNAME}.lst ${line}/31"
              done < "/tmp/${ALIASNAME}-new"

              #Set current alias file to the updated values
              mv "/tmp/${ALIASNAME}-new" "/tmp/${ALIASNAME}-cur"

              exit 0

              O 3 2 Replies Last reply Reply Quote 1
              • R
                Rupesh @PiBa
                last edited by

                @piba can you please be a little elaborate on how to do this?

                1 Reply Last reply Reply Quote 0
                • O
                  oniongate @jafath
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • 3
                    3freet @jafath
                    last edited by

                    @jafath
                    Thank you for the providing this handy script.

                    I had to make minor changes in order for it to work.
                    For anyone who might need it:

                    #!/bin/sh
#Edit this value to match pfSense alias name
ALIASNAME="infodns"

#Force update on first run - acl will be empty after restart
/usr/local/pkg/haproxy/haproxy_socket.sh show acl "/var/etc/haproxy/ipalias_${ALIASNAME}.lst" > "/tmp/${ALIASNAME}-acl"
rc=$(wc -l < "/tmp/${ALIASNAME}-acl" | awk '{print $1}')
if [ "$rc" -lt 2 ]; then echo "X" > "/tmp/${ALIASNAME}-cur"; fi

#Dump the alias table to a temp file
pfctl -t ${ALIASNAME} -T show > "/tmp/${ALIASNAME}-new"

#Check new alias table against current
diff "/tmp/${ALIASNAME}-new" "/tmp/${ALIASNAME}-cur" >/dev/null 2>&1

#If no change, just exit
rc=$?; if [ $rc == 0 ]; then exit 0; fi

#Clear current acl
/usr/local/pkg/haproxy/haproxy_socket.sh clear acl "/var/etc/haproxy/ipalias_${ALIASNAME}.lst"

#read each alias table line and add to HAproxy acl IP values
while read -r line; do
/usr/local/pkg/haproxy/haproxy_socket.sh add acl "/var/etc/haproxy/ipalias_${ALIASNAME}.lst ${line}/32"
done < "/tmp/${ALIASNAME}-new"

#Set current alias file to the updated values
mv "/tmp/${ALIASNAME}-new" "/tmp/${ALIASNAME}-cur"

#Optional Log to syslog
# logger Haproxy acl for ALIASNAME updated successfully via the update script

exit 0

                    Place it some where in pfsense (e.g /usr/customScripts/update-haproxy-ALIASNAME.sh), then add a cron entry that points to this script.

                    1 Reply Last reply Reply Quote 1
                    • cukalC
                      cukal
                      last edited by

                      @jafath said in HAProxy Source IP Alias Problem [Solved]:

                      /usr/local/pkg/haproxy/haproxy_socket.sh add acl

                      I'm a bit late to the party...
                      When checking this feature request: https://redmine.pfsense.org/issues/9793 I would say it's possible, checking the GitHub merge request you can see it should be able to parse ip table aliases.

                      I'm on 2.5.2 but do not have those entries in /usr/local/pkg/haproxy/haproxy.inc and I'm not sure if it's in 2.6 or not.

                      Anyone any idea?

                      Using the haproxy_socket.sh add acl approach works, but it's a time-consuming loop for 14k ip table lists from pfBlockerNG and I don't know ACME decides to restart HAProxy when generating new certificates.

                      Gr,
                      L

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        jokvist @cukal
                        last edited by

                        @cukal I was looking for the same thing, and can se that it is only in the devel version urltable is added: haproxy-devel

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          ciscoqid @jokvist
                          last edited by

                          I was beating my head against this the past few days, finally figured out using an alias with FQDNs was not actually working. The script above was a good starting point, but I have a new version that is more robust. Hopefully helpful to someone else! One more improvement I will make eventually is to support multiple aliases. I wanted to use the socket wrapper script, but it generated additional cruft on the first output line so I just used the socket directly. I also did not know why the original used /31 as a mask so I removed that.

                          #! /bin/sh

#Edit this value to match pfSense alias name
ALIASNAME="Foreman_Clients"

SOCKET=/tmp/haproxy.socket

#Pull current ACL from haproxy (normalize and sort by IP)
echo "show acl /var/etc/haproxy/ipalias_${ALIASNAME}.lst" | nc -U $SOCKET | sed '/^$/d' | awk '{print $2}' | sort -V > "/tmp/${ALIASNAME}-cur"

#Dump alias values to a temp file (normalize and sort by IP)
pfctl -t ${ALIASNAME} -T show | sort -V > "/tmp/${ALIASNAME}-new"

#Check new alias values against current (ignore whitespace)
diff -w "/tmp/${ALIASNAME}-new" "/tmp/${ALIASNAME}-cur" >/dev/null 2>&1 && exit 0

#Clear current acl
echo "clear acl /var/etc/haproxy/ipalias_${ALIASNAME}.lst" | nc -U $SOCKET

#Populate haproxy ACL with alias values
while read -r line; do
    echo "add acl /var/etc/haproxy/ipalias_${ALIASNAME}.lst ${line}" | nc -U $SOCKET
done < "/tmp/${ALIASNAME}-new"

#Remember current alias contents for next run
mv "/tmp/${ALIASNAME}-new" "/tmp/${ALIASNAME}-cur"

exit 0
                          A 1 Reply Last reply Reply Quote 2
                          • A
                            acc4ever @ciscoqid
                            last edited by

                            @ciscoqid thank you very much, your script solved my problem...

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post