Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ha proxy ssh add backend IP stops ssh connect

    Scheduled Pinned Locked Moved Cache/Proxy
    14 Posts 2 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nopanic
      last edited by

      Hello all,

      it has something todo with

      Use Client-IP to connect to backend servers.

      ca20506e-d3a9-4d91-9e93-32b3a4bebdb5-image.png

      When I chenge to wan all is working. But as I understand it correct, there should be "opt" set.
      But with "opt" its not working.
      Can someone help?

      Tia
      Stefan

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @nopanic
        last edited by viragomann

        @nopanic said in ha proxy ssh add backend IP stops ssh connect:

        it has something todo with

        Use Client-IP to connect to backend servers.

        When I chenge to wan all is working. But as I understand it correct, there should be "opt" set.
        But with "opt" its not working.
        Can someone help?

        Disable the transparent mode.
        What is the goal of using this?

        N 1 Reply Last reply Reply Quote 0
        • N
          nopanic @viragomann
          last edited by

          @viragomann I want the client IPs on the ssh server to block unwanted connections

          Tia
          Stefan

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @nopanic
            last edited by

            @nopanic
            You can do this on pfSense or in HAproxy as well.

            N 1 Reply Last reply Reply Quote 0
            • N
              nopanic @viragomann
              last edited by

              @viragomann okay. How? On the ssh server Im using an IDS for blocking and snort on pfsense. Are there other solutions?
              thanks!
              Stefan

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @nopanic
                last edited by

                @nopanic
                Do you want to simply block / allow certain IPs or do you need to inspect the traffic?
                For inspection you can use snort or suricata, but I'm don't think that these tools can see much in an ssh traffic, since it's encrypted.

                N 1 Reply Last reply Reply Quote 0
                • N
                  nopanic @viragomann
                  last edited by

                  @viragomann I want to inspect and in case ex. of bruteforcing block the client IP. With snort its running very well and on the the server I use ossec for blocking-

                  thanks
                  Stefan

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    nopanic @nopanic
                    last edited by

                    @nopanic courious: I disable the transparent mode and see on the server logs the client IP. Should it not be rewritten to the pfsense IP?

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @nopanic
                      last edited by

                      @nopanic
                      I would expect to see the pfSense interface IP.
                      Maybe you forward the traffic to the backend by a NAT rule?

                      N 1 Reply Last reply Reply Quote 0
                      • N
                        nopanic @viragomann
                        last edited by

                        @viragomann yes, the there is a forward nat rule

                        N 1 Reply Last reply Reply Quote 0
                        • N
                          nopanic @nopanic
                          last edited by

                          @nopanic ahh okay , I disable those rules now I see the pfsense IP. But why I can not use the "opt" interface in transparent mode?

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            nopanic @nopanic
                            last edited by

                            @nopanic nat rule disabled, no connction, Trying now the opt interface in transparent.. its running!!

                            thanks for help!!

                            N 1 Reply Last reply Reply Quote 0
                            • N
                              nopanic @nopanic
                              last edited by

                              @nopanic Hello all
                              I have to come back cause the traffic goes only from LAN to OPT. From WAN site I dont get a connection.
                              Courious: When I do tcp tranparent entries and wnat back to nat-forwarding I have to reboot the machine, so forwarding work again. I have to delete the entries and reboot. Disabling is not enough.

                              Can someone help?
                              Tia
                              Stefan

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.