• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

HAProxy TCP Mode SSL Offloading NOT WORK

Cache/Proxy
4
20
2.2k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator @the-iuser
    last edited by Mar 6, 2024, 1:36 PM

    @the-iuser did you miss @viragomann post?

    🔒 Log in to view

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

    V 1 Reply Last reply Mar 20, 2024, 4:02 AM Reply Quote 0
    • V
      Victor 6 @johnpoz
      last edited by Victor 6 Mar 20, 2024, 4:06 AM Mar 20, 2024, 4:02 AM

      @johnpoz
      use what you say and it doesn't work at all although it seems a bit absurd and pointless to me the truth that haproxy can't handle a certificate in tc
      When I try to connect in the mode you tell me it does not work and I explain in detail

      1:when I log on I get this problem
      🔒 Log in to view

      2:even though the connection comes through tcp and connects to port 6690 you get the problem but it does register the connection.
      🔒 Log in to view

      3:the haproxy configuration at frontend level I did it in 2 ways and I explain it the way without (SSL Offloading)
      🔒 Log in to view

      🔒 Log in to view

      🔒 Log in to view

      🔒 Log in to view

      🔒 Log in to view

      4: backend configuration
      🔒 Log in to view

      and this way does not work
      and if I activate ssl offloading it doesn't work either.

      I've been fighting with this for a couple of weeks now and I can't make sense of it.

      but if I activate tcp mode I can log in but I can't use the certificate.

      🔒 Log in to view

      J V 2 Replies Last reply Mar 20, 2024, 8:42 AM Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator @Victor 6
        last edited by johnpoz Mar 20, 2024, 8:53 AM Mar 20, 2024, 8:42 AM

        @Victor-6 said in HAProxy TCP Mode SSL Offloading NOT WORK:

        I've been fighting with this for a couple of weeks now and I can't make sense of it.

        Not sure what part your not understanding that haproxy can not do ssl offloading with tcp mode.. If you want to use tcp mode and a cert, then backend must have a certificate, the ssl cert your using would have to be valid.. ie in that it works, and your service your sending traffic to via the backend would have to be using it.

        Here this took all of 30 seconds to setup.

        I fired up a website on my nas using a cert on port 44443.. I then created a frontend in tcp mode on my pfsense wan IP, that sends it to a backend on 44443.. Clicky Clicky bobs your uncle..

        Sure I got a warning about the cert, because I couldn't be bothered to setup a cert with valid CN and or San and a dns record that pointed the fqdn that to point to my wan IP..

        🔒 Log in to view

        Notice the states at the end - my pc hitting my wan IP on port 44443, which is then proxied to my nas at 192.168.9.10 on port 44443 from my pfsense lan IP 192.168.9.253

        You can see on the connection info for the https connection, that it shows that site CA was just one of my pfsense CAs that I named home, the cert I used I had created for different CN and SANS - which is why browser throws up a warning. Because that info is not matching with where I went.. But the cert is still valid and the service is using it.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        V 1 Reply Last reply Mar 26, 2024, 10:18 PM Reply Quote 0
        • V
          viragomann @Victor 6
          last edited by Mar 20, 2024, 11:27 AM

          @Victor-6 said in HAProxy TCP Mode SSL Offloading NOT WORK:

          When I try to connect in the mode you tell me it does not work and I explain in detail

          If you check "SSL offloading" the frontend listening section you get an SSL offloading section at the bottom, where you have to select the proper SSL certificate.
          Did you do this? Your screens don't show.

          🔒 Log in to view

          1 Reply Last reply Reply Quote 0
          • V
            Victor 6 @johnpoz
            last edited by Mar 26, 2024, 10:18 PM

            @johnpoz
            question and to clarify

            the ssl certificate you load it in the backend ( in the option where it says Encrypt(SSL)) or not

            or I have to create a certificate inside my synology nas for the drive server port ? and if so and if I have some synology will not be cumbersome to create certificate for one and should not control haproxy ?

            do you know if OPNsense is possible?

            J 1 Reply Last reply Mar 26, 2024, 10:29 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @Victor 6
              last edited by Mar 26, 2024, 10:29 PM

              @Victor-6 huh? I have no idea what that other distro does or doesn't do - but pretty sure this is a limitation of haproxy..

              You can either pass through the traffic with tcp mode and let the cert on the destination do its thing. Or you can do ssl offload and load the cert in haproxy, you could either talk to the backend in the clear, or you can also do a cert there, but if your going to go that route then haproxy would have to trust that cert you have on the destination.

              You can for sure use acme on synology. But I think your problem is you don't even know what your trying to do..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              V 2 Replies Last reply Mar 26, 2024, 10:48 PM Reply Quote 0
              • V
                Victor 6 @johnpoz
                last edited by Mar 26, 2024, 10:48 PM

                @johnpoz
                first thank you for your help

                second it is clear what I want to do for something I made a graph or you can check in the part above.

                second
                you are clear that the port that you use synology drive?? the desktop applications

                you gave me an example that is the same thing I do and that is not the problem.

                have you tried with your mac or windows desktop applications to connect that way?

                I have used the ssl offload on both the front and back end and it does not work.

                or what would be the configuration that allows a synology user desktop application to connect to my NAS?

                I have used the ssl offload on both the front and back end and it does not work.

                Translated with DeepL.com (free version)

                1 Reply Last reply Reply Quote 0
                • V
                  Victor 6 @johnpoz
                  last edited by Mar 26, 2024, 11:07 PM

                  @johnpoz 🔒 Log in to view

                  J 1 Reply Last reply Mar 27, 2024, 12:56 AM Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator @Victor 6
                    last edited by Mar 27, 2024, 12:56 AM

                    @Victor-6 ok maybe I am lost in what exactly your wanting to accomplish - but this took all of 2 minutes to setup

                    I created a frontend, tcp - pointed it to my backend, no health check..

                    Installed the drive client - pointed it to my wan IP so haproxy would see it, and gave me a warning about the cert.. Because its a local cert and clicked ok and away it goes. I added some file in my folder and they got sync'd to my nas

                    🔒 Log in to view

                    Why does this not work for you? If you want to have a cert that your client trusts then put one on the nas.. What does it matter if the cert is legit or not legit? Its a one time click through to have the client trust it.. And there you go - the traffic is encrypted and sync

                    Not understanding the use case here.. Why would you want/need haproxy to do ssl offloading? Just put a trusted cert on your nas if you do not want the "ONE" time warning?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    V 1 Reply Last reply Mar 27, 2024, 3:22 PM Reply Quote 0
                    • V
                      Victor 6 @johnpoz
                      last edited by Mar 27, 2024, 3:22 PM

                      @johnpoz
                      I totally appreciate your help just as many here, what you express in your graphs is what I already did above and many people have done.
                      What I was even mentioning in the graphic is that I DO NOT WANT MY NAS SYNOLOGY TO HANDLE THAT, I WANT PFSENSE TO HANDLE THAT INSTEAD OF MY NAS SYNOLOGY.
                      I explained all the steps you shared with me in what is found in forums and so on
                      but the big question and how should be the configuration is:
                      HOW CAN I MAKE MY PFSENSE MANAGE THE CERTIFICATE INSTEAD OF MY SYNOLOGY, that is the million question.
                      how to configure it to be pfsense that handles that and what is the correct configuration to make use of certificates that are in pfsense and not in synology

                      J 1 Reply Last reply Mar 27, 2024, 3:43 PM Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator @Victor 6
                        last edited by johnpoz Mar 27, 2024, 3:49 PM Mar 27, 2024, 3:43 PM

                        @Victor-6 said in HAProxy TCP Mode SSL Offloading NOT WORK:

                        I DO NOT WANT MY NAS SYNOLOGY TO HANDLE THAT, I WANT PFSENSE TO HANDLE THAT INSTEAD OF MY NAS SYNOLOGY.

                        And its not going to work that way.. Talk to synology about their application.

                        Why is the question.. You can just use the default synology cert, a simple port forward or let haproxy proxy it.. Your just causing yourself grief trying to get something to work that serves no actual purpose.. You setup the application, and click trust this cert - ONE TIME!! There is no extra security... Your trying to jump through a bunch of hoops and configure this, and configure that when its a 1 minute click here and your good.

                        For ssl offload to work, the bankend has to be http based not just tcp.. that is not how this application works.. So no you can't do ssl offload on haproxy.. But again your just doing work for no benefit..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        V 1 Reply Last reply Mar 27, 2024, 5:16 PM Reply Quote 0
                        • V
                          Victor 6 @johnpoz
                          last edited by Mar 27, 2024, 5:16 PM

                          @johnpoz
                          so practically if or if I have to install the certificate on my nas synology
                          I handle some networking, but the truth is super weird to believe that there is no possibility that a firewall can not be configured in some existing way so that in tcp load the certificate
                          because in many forums people want pfsense/haproxy to take care of this, not the nas (for the same reason they don't want to install the certificate on their nas).
                          I hope to find someday the solution or the firewall or the steps to allow it to somehow load the certificate and not the equipment (nas synology).

                          you would know how to configure to do it pfsense/haproxy or you really do not know (that's why you give me the simplest option that is repeated in all places)

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.