Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Haproxy setup help

    General pfSense Questions
    2
    37
    13.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      PiBa
      last edited by

      Config recieved. Looks like you didnt configure the 'action' part from my screenshot above?

      Is the redirect the only current issue.? Or are there others i should look at?

      1 Reply Last reply Reply Quote 0
      • R
        rajbps
        last edited by

        thats the bit and if you can see anything to harden security thats always welcome

        1 Reply Last reply Reply Quote 0
        • P
          PiBa
          last edited by

          Ok so add the redirect 'action' as in my screenshot ? I think that should fix the redirect part.

          As a minor observation i'm wondering about for example 'email' and 'support' are using different acl's matches v.s. contains is that intentional? should othersubdomain.support.mydomain.com also be send to the same backend as support.mydomain.com ?

          You passing https straight to the backend, and using transparent-client-ip, should work.. and i assume you have read the warning, and understand it can cause some issues.. (it might bite you later when you want to connect another way and cant seem to get it working, the 'transparent-client-ip' might be the culprit..) Though there arn't really much other options for some backends.. Just saying ;)

          1 Reply Last reply Reply Quote 0
          • R
            rajbps
            last edited by

            when I add the second bit and try to save and apply, I get the following error :

            Errors found while starting haproxy
            [ALERT] 299/234604 (87967) : parsing [/var/etc/haproxy_test/haproxy.cfg:39] : error detected in frontend 'Loki-merged' while parsing 'http-request redirect' rule : expects 'code', 'prefix', 'location', 'scheme', 'set-cookie', 'clear-cookie', 'drop-query' or 'append-slash' (was 'Support').
            [ALERT] 299/234604 (87967) : Error(s) found in configuration file : /var/etc/haproxy_test/haproxy.cfg

            1 Reply Last reply Reply Quote 0
            • R
              rajbps
              last edited by

              http-request redirect See below httpsredirect

              rule: Support

              1 Reply Last reply Reply Quote 0
              • R
                rajbps
                last edited by

                "As a minor observation i'm wondering about for example 'email' and 'support' are using different acl's matches v.s. contains is that intentional? should othersubdomain.support.mydomain.com also be send to the same backend as support.mydomain.com ?"

                In regards to the email and support, if i got it correctly, i have a different backend for each url as they go to different servers. Then I have one https frontend and sub frontend that share the primary https front end. If there is a better more efficient way to do it please advise as I am very new to haproxy and this is a learning curve for me .

                Cheers for all the help though.

                Rajbps

                1 Reply Last reply Reply Quote 0
                • P
                  PiBa
                  last edited by

                  @rajbps:

                  http-request redirect See below httpsredirect

                  rule: Support

                  For a simple https redirect the 'rule' should be:

                  scheme https

                  no more no less :)

                  1 Reply Last reply Reply Quote 0
                  • R
                    rajbps
                    last edited by

                    yep error gone  :-)

                    1 Reply Last reply Reply Quote 0
                    • P
                      PiBa
                      last edited by

                      The usage of multiple backends and acl's is good. And it will probably work OK.

                      The question i got was for example about these acl's:

                         acl         OWA   req.ssl_sni -i email.mydomain.com
   acl         Support   req.ssl_sni -m sub -i support.mydomain.com

                      Where email is using an 'exact match', the other for support is checking if the it is 'part of' the requested domain. I would expect a little that you would use "Server Name Indication TLS extension matches:" for all those acl expression's, and not have a few with "Server Name Indication TLS extension contains:".

                      If it would look like this it would probably be a little better, though probably it wouldnt make much of a difference :)..

                         acl         OWA   req.ssl_sni -i email.mydomain.com
   acl         Support   req.ssl_sni -i support.mydomain.com
                      1 Reply Last reply Reply Quote 0
                      • R
                        rajbps
                        last edited by

                        Is there a way to get a log of ips of live connections to the webservers please?

                        1 Reply Last reply Reply Quote 0
                        • P
                          PiBa
                          last edited by

                          The dashboard widget has the ability to show currently connected clients..
                          But best is probably to run a syslog server on the network and let haproxy send its syslog messages there. On the settings tab og haproxy package you can fill in the syslog server to send the udp traffic to.

                          1 Reply Last reply Reply Quote 0
                          • R
                            rajbps
                            last edited by

                            Hi PiBA,

                            I have exchange running behind haproxy fine and just added a new server with a new domain and vlan and that works well for webinterface but not for connecting the phones. Email box is Iredmail. If I redirect all https traffic direct to that Iredmail box then the phone will connect from external but as soon as i put haproxy in the mix I get stuck. Could you advise please?

                            Rajbps

                            1 Reply Last reply Reply Quote 0
                            • P
                              PiBa
                              last edited by

                              Whats the config, what requests are send, why does your application not work? As i'm not using Iredmail and you haven't included much info about requests/configs/errors/logs there ain't much i can advice..

                              1 Reply Last reply Reply Quote 0
                              • R
                                rajbps
                                last edited by

                                Hi Piba,

                                I am new to it myself so I do not know much. The maintenainer of the project for Iredmail said just to open port 443. If i point port 443 direct to the the Iredmail server, the phone works but when I put HAproxy back in the mix then it does not work. There is not much in the logs for sogo also :-(

                                1 Reply Last reply Reply Quote 0
                                • R
                                  rajbps
                                  last edited by

                                  ok might have made some progress. installed a syslog and changed HAproxxy to log everything. When I try to connect the phone from external this is what syslog shows me as error:

                                  Nov 24 22:40:44 192.168.3.251 ffww syslog notice haproxy[96712] Proxy Iredmail_https_ipvANY started.
                                  Nov 24 22:40:52 192.168.3.251 ffww syslog info haproxy[96902] X.X.X.X:59323 [24/Nov/2016:22:40:52.070] HTTPS-merged Iredmail_https_ipvANY/mailer 1/0/111 1866 – 1/1/0/0/0 0/0
                                  Nov 24 22:40:57 192.168.3.251 ffww syslog err haproxy[96902] X.X.X.X:23380 [24/Nov/2016:22:40:52.089] HTTPS-merged HTTPS-merged/ <nosrv>-1/-1/5002 0 SC 0/0/0/0/0 0/0
                                  Nov 24 22:41:07 192.168.3.251 ffww syslog err haproxy[96902] X.X.X.X:40317 [24/Nov/2016:22:41:07.378] HTTPS-merged HTTPS-merged/ <nosrv>-1/-1/0 0 SC 0/0/0/0/0 0/0
                                  Nov 24 22:41:25 192.168.3.251 ffww syslog info haproxy[96902] X.X.X.X:10799 [24/Nov/2016:22:41:25.175] HTTPS-merged Iredmail_https_ipvANY/mailer 1/0/132 1866 – 1/1/0/0/0 0/0

                                  Hope this helps

                                  Rajbps</nosrv></nosrv>

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    PiBa
                                    last edited by

                                    The "<nosrv>" looks like it might be a problem. It usually means the request does not match the acl's used for the use_backend action. Can you share the haproxy.cfg file from bottom of settings tab?</nosrv>

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      rajbps
                                      last edited by

                                      will send you in a pm in a few min

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        PiBa
                                        last edited by

                                        Could you try configuring the Iredmail backend as the default backend?

                                        Also afaik a SNIvalue will never contain a 'path' like /owa it might contain a portnumber though.. So add a acl for both  mailer.example.com and mailer.example.com:443 also try capturingnthe phone requests in a wireshark capture, the ssl connection packetshould show if/what sni value is send.

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          rajbps
                                          last edited by

                                          Cheers for that by changing the default to of the Iredmail frontend, the backend bit from default to Iredmail did the trick. Thanks so much for all the help. I am going to change the owa part now and see what happens

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            rajbps
                                            last edited by

                                            Just send you a new pm with the new change. Would you suggest doing the same with the other front ends?

                                            Cheers,

                                            Rajbps

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.