Haproxy setup help

[PiBa]

Something like this.


[rajbps]

Hiya, the "scheme https" is that the main front end for https or the shared front end which uses https front end as primary please?

[PiBa]

It just redirects the client from http://support to https://support, so after that initial http request the 'usual route' for that website will end up on one of your frontends that listen on :443.

[rajbps]

is there a way for me to get the config out of pfsense and send it to you in private pls?

[PiBa]

The generated haproxy configuration can be seen at the bottom of the settings tab in the package, there is a button to show it.

As for getting it to me you could send me a PM through the forum if thats ok for you?. Anyhow replace passwords/public ip's/domainnames by similar but dummy values where needed. (do make sure to replace a name or ip you want to replace by the same value each time so it still makes sense..)

[rajbps]

pm sent

[PiBa]

Config recieved. Looks like you didnt configure the 'action' part from my screenshot above?

Is the redirect the only current issue.? Or are there others i should look at?

[rajbps]

thats the bit and if you can see anything to harden security thats always welcome

[PiBa]

Ok so add the redirect 'action' as in my screenshot ? I think that should fix the redirect part.

As a minor observation i'm wondering about for example 'email' and 'support' are using different acl's matches v.s. contains is that intentional? should othersubdomain.support.mydomain.com also be send to the same backend as support.mydomain.com ?

You passing https straight to the backend, and using transparent-client-ip, should work.. and i assume you have read the warning, and understand it can cause some issues.. (it might bite you later when you want to connect another way and cant seem to get it working, the 'transparent-client-ip' might be the culprit..) Though there arn't really much other options for some backends.. Just saying ;)

[rajbps]

when I add the second bit and try to save and apply, I get the following error :

Errors found while starting haproxy
[ALERT] 299/234604 (87967) : parsing [/var/etc/haproxy_test/haproxy.cfg:39] : error detected in frontend 'Loki-merged' while parsing 'http-request redirect' rule : expects 'code', 'prefix', 'location', 'scheme', 'set-cookie', 'clear-cookie', 'drop-query' or 'append-slash' (was 'Support').
[ALERT] 299/234604 (87967) : Error(s) found in configuration file : /var/etc/haproxy_test/haproxy.cfg

[rajbps]

http-request redirect See below httpsredirect

rule: Support

[rajbps]

"As a minor observation i'm wondering about for example 'email' and 'support' are using different acl's matches v.s. contains is that intentional? should othersubdomain.support.mydomain.com also be send to the same backend as support.mydomain.com ?"

In regards to the email and support, if i got it correctly, i have a different backend for each url as they go to different servers. Then I have one https frontend and sub frontend that share the primary https front end. If there is a better more efficient way to do it please advise as I am very new to haproxy and this is a learning curve for me .

Cheers for all the help though.

Rajbps

[PiBa]

@rajbps:

http-request redirect See below httpsredirect

rule: Support

For a simple https redirect the 'rule' should be:

scheme https

no more no less :)

[rajbps]

yep error gone  :-)

[PiBa]

The usage of multiple backends and acl's is good. And it will probably work OK.

The question i got was for example about these acl's:

   acl         OWA   req.ssl_sni -i email.mydomain.com
   acl         Support   req.ssl_sni -m sub -i support.mydomain.com

Where email is using an 'exact match', the other for support is checking if the it is 'part of' the requested domain. I would expect a little that you would use "Server Name Indication TLS extension matches:" for all those acl expression's, and not have a few with "Server Name Indication TLS extension contains:".

If it would look like this it would probably be a little better, though probably it wouldnt make much of a difference :)..

   acl         OWA   req.ssl_sni -i email.mydomain.com
   acl         Support   req.ssl_sni -i support.mydomain.com

[rajbps]

Is there a way to get a log of ips of live connections to the webservers please?

[PiBa]

The dashboard widget has the ability to show currently connected clients..
But best is probably to run a syslog server on the network and let haproxy send its syslog messages there. On the settings tab og haproxy package you can fill in the syslog server to send the udp traffic to.

[rajbps]

Hi PiBA,

I have exchange running behind haproxy fine and just added a new server with a new domain and vlan and that works well for webinterface but not for connecting the phones. Email box is Iredmail. If I redirect all https traffic direct to that Iredmail box then the phone will connect from external but as soon as i put haproxy in the mix I get stuck. Could you advise please?

Rajbps

[PiBa]

Whats the config, what requests are send, why does your application not work? As i'm not using Iredmail and you haven't included much info about requests/configs/errors/logs there ain't much i can advice..

[rajbps]

Hi Piba,

I am new to it myself so I do not know much. The maintenainer of the project for Iredmail said just to open port 443. If i point port 443 direct to the the Iredmail server, the phone works but when I put HAproxy back in the mix then it does not work. There is not much in the logs for sogo also :-(