HAProxy & Cloudflare - 526 Invalid SSL
-
Hi All,
Been having some issues setting up HAProxy as a reverse proxy for my services. What i aim to achieve is use Cloudflare network to access my services securely over the wan. have ha proxy handle my services that are on the same ports [80 / 443] i have a couple i cannot change the port numbers and can not run through the Cloudflare ZTP tunnel service as it would be a breach of service.
So I have managed to get everything installed and setup [ To the best of my knowledge ] but i receive Cloudflare Error 526 - invalid SSL. Any help ficing this would be apreciated
Please see my configs and methodology below
I am aware internal IPs are on show this is a test network that wil be terminated after this posting.
!!! ALL CONFIGS HAVE BEEN ANONYMISED & GIVE NO REVELLING INFO !!!
- PFSense
- GUI Port change
Going into the system Advance tab I moved the default port for PFSense GUI [443] to a secure port for my admin network [FIG 1].
- Aliases Creation
Using the firewall tab I created aliases for the following [FIG 2]...
- IP Networks[Contains all cloudflares proxy networks] up too date as of 2023
- Prots required for HAProxy [80 & 443]
- Port Forwarding
Again using the firewall tab I created a port forward from WAN to firewall itself [as HAProxy has been installed on the firewall] using the aliases created above, I have limited the source to cloudflare proxy networks as the DNS config on cloudflare will be proxied [FIG 3].
- Certification
Using the system tab i uploaded my cloudflare origin certificate, key & cloudflare authorities certificate [FIG 4].
- HAProxy
Using the services tab i configured HAProxy, I created a backend [In this example i'm using PLEX], gave it a name server listing & disabled health checking. No SSL was added here as the server does not have any ssl certificates setup [FIG 5].
I created a shared front end for HTTP:// & HTTPS://. Under External addresses i selected WAN - Ports 80 / 443, click the SSL Offloading next to 443 & confirmed that type was set to http / https (Offloading) [FIIG 6].
I created an ACL for PLEX & An Action too be taken if the ACL is triggered [FIG 7]
Under SSL Offloafing I selected my SSL Certificate i uploaded earlier [FIG8].
From what i can gather i have setup the PFSense box & haProxy to in theory successfully proxy my internal services.
- Images
FIG 1
FIG 2
FIG3
FIG4
FIG 5
FIG 6
FIG 7
FIG 8
- Cloudflare
- DDNS Magic
So i have had do a bit of black magic here as my ISP does not offer static IPs & the DHCP Leases are stupidly short.
Using my PFSense box i have had to setup a proxied DDNS, so i'm using Cloudflare to do this as-well. PFSense logs into my cloudflare account via a dedicated API Token allowing it to read my Domains DNS & update an A record with my external ip every 30 Mins.
- DNS Record for HAProxy
I have created a Cname record for plex pointing towards the A record updated by PFSense DDNS system this to is proxied [FIG 1].
- Images
FIG 1
-
Did you manage to get it working as I am doing the same thing but have noticed Cloudflare Proxied traffic seems to really be slow......not sure if there is something in Cloudflare that needs tweaking but it is pretty much unusable
