HAProxy - Include subdirectories in the HTTP Redirect

[ColdBrew]

Re: [RESOLVED] Request for help HAPROXY redirection to subdirectory.

I'm setting up HAProxy so load-balance an HTTP server. After setting up the frontend and backend, with a virtual IP in pfSense, it's working when I visit the alias IP. But subdirectories, such as typing "http://<IP alias>/files", it fails with nginx page not found:

I imagine I need to set ACL and Action(s) to forward the path the client is trying to access, but I'm not familiar with how. The forum post I linked at the top of this post seems to do what I need to, albeit tedious as you have to create an action for every single subdirectory. There's gotta be a way to do a catchall forward for all paths, right?

Thank you!

[viragomann]

@ColdBrew said in HAProxy - Include subdirectories in the HTTP Redirect:

But subdirectories, such as typing "http://<IP alias>/files", it fails with nginx page not found:

Are you sure, that it's the backend responding with this error?
It could also come from the pfSense web server.

To avoid the latter, go to System > Advanced > Admin Access and check Disable webConfigurator redirect rule and ensure the the TCP port for the webGUI is set to any unused port (other than 80, 443).

Basically HAproxy doesn't change the path, as long as you didn't add according rules.

[ColdBrew]

@viragomann Yes it's definitely pfSense, because the target server is Windows Server 2019 and is using IIS.

I'll check my pfSense config for that redirect rule and consider hosting the webConfigurator on a different port. Thanks!

[ColdBrew]

@viragomann Well.. I changed the webConfigurator port to 8443 and disabled the redirect, now specifying a subdirectory just times out, although just http://target-host still works. At least it's clear that pfSense (mostly) isn't using port 80 for webConfigurator anymore, though I may still be missing some settings in HAProxy.

Basically HAproxy doesn't change the path, as long as you didn't add according rules.

So by this are you implying that HAProxy should just pass the whole directive by default?

[viragomann]

@ColdBrew said in HAProxy - Include subdirectories in the HTTP Redirect:

So by this are you implying that HAProxy should just pass the whole directive by default?

Yes, HAproxy passes the whole path and query to the backend by default, as well as the headers (host), but it goes to the IP and port, you've stated in the backend.

What happens, when you only enter the host name without a subdirectory?

If you state a subfolder, is this even available on the backend?
Does HAproxy even connect to the correct website on the backend?

[johnpoz]

@ColdBrew I have haproxy setup for a few sites, and can access different paths just fine - didn't have to do anything special and just point to the backend.

[ColdBrew]

@viragomann Yes, just the host name itself properly gets redirected to the target HTTP server, it's once I specify a subdirectory that, now, it's just timing out. And yes, the subdirectory is available on the backend, I'm typing the same full address with only the host different to compare the direct connection vs through HAProxy.

[ColdBrew]

@johnpoz Alright, something must be incorrectly configured or conflicting in my setup, at least I know it's not required to configure it a certain way to make these subdirectories work.

Thank you all for your help, I'll continue to mess with this.

[viragomann]

@ColdBrew
Check the log on the backend server, to see, what HAproxy requests exactly.
As mentioned above, HArproxy uses the IP and port, you've stated in the backend config.
And I guess, if you use this IP an port and append the subdirectory (e.g. http://10.65.10.5:3454/subdir) you get nothing from the backend device as well.

[Firehouses]

@ColdBrew @viragomann @johnpoz

This is an interesting discussion, and I’ve run into similar issues with HAProxy and subdirectory redirection. From what I understand, HAProxy should pass the entire path (including subdirectories) to the backend by default, as long as the backend is properly configured to handle those requests.

A few things to check:

1. Backend Configuration: Ensure the backend server (IIS in your case) is correctly set up to handle requests for the subdirectories. Sometimes, the issue might be with the backend’s routing or permissions.
2. HAProxy Logs: Check the HAProxy logs to see if the requests are being forwarded correctly. If the logs show the requests reaching HAProxy but not the backend, it might be a routing or firewall issue.
3. Firewall Rules: Double-check your pfSense firewall rules to ensure traffic on port 80 (or any custom port) is allowed to pass through to the backend server.

If everything seems correct but it’s still timing out, you might want to test with a simpler backend (like a basic HTTP server) to rule out any IIS-specific issues.

Let us know how it goes!