Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HAProxy multiple subdomains

    Scheduled Pinned Locked Moved
    Cache/Proxy
    2
    9
    812
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      iruindegi
      last edited by

      Hi,

      I have configured app1.duckdns.org with DDNS + Let's encrypt + HA Proxy with a Virtual Ip (NAT/Port Foward 443) in my VLAN_40 (192.168.40.10). It works perfect.

      Now I need another app2.duckdns.org but this one has to go to my VLAN_30 (192.168.30.10).
      I got the DDNS to work without problems.

      But I can't get the certificate or the HA Proxy to work.

      Besides, having the port foward to a Virtual IP in the VLAN_40... How can I make it work also with the VLAN_30?

      Thanks in advance

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @iruindegi
        last edited by

        @iruindegi
        If you forward traffic from your WAN IP to a device behind pfSense, you bypass HAproxy in fact. So HAproxy can't do anything on this traffic.

        I 1 Reply Last reply Reply Quote 0
        • I
          iruindegi @viragomann
          last edited by

          @viragomann thx! I understand but whats can I do?

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @iruindegi
            last edited by

            @iruindegi
            You have to let HAproxy do the forwarding.

            Remove the port forwarding rule and add a firewall rule to allow access to the WAN IP on port 80 and 443 (assuming you want to handle web traffic).

            Configure both backends in HAproxy and the frontend to read the host headers and forward the traffic accordingly to the desired backend.

            I 1 Reply Last reply Reply Quote 0
            • I
              iruindegi @viragomann
              last edited by

              @viragomann thx! for yout help. I removed the port foward and tried to do whats you said but I can't... de first domain it working ok but when I try to access to the second I got
              503 Service Unavailable
              No server is available to handle this request.

              Where can I set, as you say, the "host headers" ??

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @iruindegi
                last edited by

                @iruindegi
                Can you give some more details about what you want to achieve?

                Are both services HTTP(S)?
                Are both using the same public IP?
                Do you have configured the HAproxy backends accordingly?

                I 1 Reply Last reply Reply Quote 0
                • I
                  iruindegi @viragomann
                  last edited by iruindegi

                  @viragomann Hi and thank you again!! My goal is to use app1.duckdns.org for Home Assistant and app2.duckdns.org for seafile, both oh them selfhosted on my server. Home Assistant is on VLAN_IOT and the rest of the services will be on my LAN
                  This is my current config:

                  • Changed my pfsense https por to a diferent one
                  • DDNS app1.duckdns.org and app.duckdns.org. OK.
                  • System / Advanced / Firewall & NAT => Pure NAT
                  • Firewall / NAT -> removed 443 port fowarding to Virtual IP
                  • Firewall / Rules / Wan:

                  50351748-4804-425d-8923-1d184605dd37-irudia.png

                  • Services / Acme / Certificates:
                    4dd11d6f-d815-4a8e-b1a3-5ec77cf0ce5d-irudia.png

                  • Services / HAProxy / Frontend: I have one frontend:
                    fa8c509c-a90b-49dc-9bd2-899d81994057-Screenshot 2023-11-27 at 18-32-03 suhesia.iruindegi.local - Services HAProxy Frontend Edit.png

                  • Services / HAProxy / Frontend: I have 2 backend (but I have 2 more on mind)
                    3b14022b-a3a8-47cc-99e0-8310a8fa4b11-irudia.png

                  This is the Home Assistant backend:
                  9f8932a8-4002-40f7-8ed9-685a4f76c1e0-irudia.png

                  And this is the SeaFile backend:
                  b9e0de4a-8da1-48ba-b9fe-afa3e60d91ed-irudia.png

                  Thanks and sorry for the long post...
                  file:///home/local/PASAIA/iibarguren/Irudiak/Screenshot%202023-11-27%20at%2018-32-03%20suhesia.iruindegi.local%20-%20Services%20HAProxy%20Frontend%20Edit.png

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @iruindegi
                    last edited by

                    @iruindegi
                    You're missing the certificate for the second host name in the frontend.
                    You've to state it here
                    d2bd6305-b2ed-4437-8d0c-17604eb1e499-grafik.png
                    and check "Add ACL for certificate CommonName".

                    I 1 Reply Last reply Reply Quote 0
                    • I
                      iruindegi @viragomann
                      last edited by

                      @viragomann Thank you!

                      I've got it working. I had 2 problems:

                      • From what I have read, duckdns shares the txt file for let's encrypt on all your subdomains, that is the reason why the second SSL certificate Issue never completed.
                      • I have created another subdomain (in one custom domain), created the certificate and selecting it in Additional Certificates everything worked.

                      Thanks again

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post