Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    ha proxy ssh add backend IP stops ssh connect

    Cache/Proxy
    2
    14
    753
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nopanic last edited by

      Hello all,
      Im running the latest pfsense with haproxy. It s a natted env. Im having a ssl/http proxy to an ssh server that works for month.
      Today it stops, dont know why. Im fiddeling some hours around and could determine the "IP field" in "haproxy-backend" makes problems. Adding the correct internal IP in the IP filed stops the ssh connection and im not able to reconnect. Change the IP to an unused one makes the ssh connect ready. No matter if the backend is disabled. Setting the IP to an unused one works. 5 hours to checking this...
      ![alt text]23c19fce-cf0c-4e3e-8ad0-cb4905909d62-image.png (image url)

      Can someone help?
      Tia
      Stefan

      1 Reply Last reply Reply Quote 0
      • N
        nopanic last edited by

        Hello all,

        it has something todo with

        Use Client-IP to connect to backend servers.

        ca20506e-d3a9-4d91-9e93-32b3a4bebdb5-image.png

        When I chenge to wan all is working. But as I understand it correct, there should be "opt" set.
        But with "opt" its not working.
        Can someone help?

        Tia
        Stefan

        V 1 Reply Last reply Reply Quote 0
        • V
          viragomann @nopanic last edited by viragomann

          @nopanic said in ha proxy ssh add backend IP stops ssh connect:

          it has something todo with

          Use Client-IP to connect to backend servers.

          When I chenge to wan all is working. But as I understand it correct, there should be "opt" set.
          But with "opt" its not working.
          Can someone help?

          Disable the transparent mode.
          What is the goal of using this?

          N 1 Reply Last reply Reply Quote 0
          • N
            nopanic @viragomann last edited by

            @viragomann I want the client IPs on the ssh server to block unwanted connections

            Tia
            Stefan

            V 1 Reply Last reply Reply Quote 0
            • V
              viragomann @nopanic last edited by

              @nopanic
              You can do this on pfSense or in HAproxy as well.

              N 1 Reply Last reply Reply Quote 0
              • N
                nopanic @viragomann last edited by

                @viragomann okay. How? On the ssh server Im using an IDS for blocking and snort on pfsense. Are there other solutions?
                thanks!
                Stefan

                V 1 Reply Last reply Reply Quote 0
                • V
                  viragomann @nopanic last edited by

                  @nopanic
                  Do you want to simply block / allow certain IPs or do you need to inspect the traffic?
                  For inspection you can use snort or suricata, but I'm don't think that these tools can see much in an ssh traffic, since it's encrypted.

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    nopanic @viragomann last edited by

                    @viragomann I want to inspect and in case ex. of bruteforcing block the client IP. With snort its running very well and on the the server I use ossec for blocking-

                    thanks
                    Stefan

                    N 1 Reply Last reply Reply Quote 0
                    • N
                      nopanic @nopanic last edited by

                      @nopanic courious: I disable the transparent mode and see on the server logs the client IP. Should it not be rewritten to the pfsense IP?

                      V 1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @nopanic last edited by

                        @nopanic
                        I would expect to see the pfSense interface IP.
                        Maybe you forward the traffic to the backend by a NAT rule?

                        N 1 Reply Last reply Reply Quote 0
                        • N
                          nopanic @viragomann last edited by

                          @viragomann yes, the there is a forward nat rule

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            nopanic @nopanic last edited by

                            @nopanic ahh okay , I disable those rules now I see the pfsense IP. But why I can not use the "opt" interface in transparent mode?

                            N 1 Reply Last reply Reply Quote 0
                            • N
                              nopanic @nopanic last edited by

                              @nopanic nat rule disabled, no connction, Trying now the opt interface in transparent.. its running!!

                              thanks for help!!

                              N 1 Reply Last reply Reply Quote 0
                              • N
                                nopanic @nopanic last edited by

                                @nopanic Hello all
                                I have to come back cause the traffic goes only from LAN to OPT. From WAN site I dont get a connection.
                                Courious: When I do tcp tranparent entries and wnat back to nat-forwarding I have to reboot the machine, so forwarding work again. I have to delete the entries and reboot. Disabling is not enough.

                                Can someone help?
                                Tia
                                Stefan

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post