I tried, I can't get it to work

makeitso

So, I've been reading, watching videos, pulling my hair out, cussing a lot and I still can't get HAProxy to work.

At the moment, I have HAProxy disabled. I'm not sure what to do next.

Anyway, what I have is 3 synology NAS devices I want to put behind a reverse proxy. They all 3 have to be accessible via the internet to one degree or another.

I have mailcow sitting around doing its job. I guess it would have to be behind a reverse proxy too. Maybe not.

I also want to connect to nextcloud outside my house as well. I plan on using it to plan family talks and so forth. I have family members that are very far away. Also, it's fun to clown around with.

Doesn't have to be HAProxy, Caddy? Anything that works. I have gone through so many different ways to do what I'm trying to do that I feel like crying.

I've been concentrating my efforts on HAProxy because it comes with pfsense.

If any of you smarter more knowledgeable than me people are willing to help a person out, I would very much appreciate it. Just tell me what I need to put out here and I'll gather it up and post it.

Thanks, Jack

Gertjan

@makeitso said in I tried, I can't get it to work:

Anything that works

Aha : What about KIS ?
No need to use a proxy ...
For every web server (a NAS) : "Do what we're doing since the seventies, last century : create a NAT rule".
Creating a NAT rule is the same thing on every existing router on planet earth.
pfSense seems more complicated as there are (to many) options. You can leave nearly everything on 'default'.

Probably two for each web server (NAS) if you want use 'http' (port 80) and https (port 443).

Let's image you have an URL that points to your pfSense WAN IP : "your-home.dynds.org"

From now on, you could use :
http://your-home.dynds.org:80 (and/or http://your-home.dynds.org:443 if your FIRST web server NAS does 'https' correctly which means you have the certificates)
and also :
http://your-home.dynds.org:81 (and/or http://your-home.dynds.org:444 if your SECOND web server NAS does 'https' correctly which means you have the certificates)
and also :
http://your-home.dynds.org:82 (and/or http://your-home.dynds.org:445 if your SECOND web server NAS does 'https' correctly which means you have the certificates)

So you create 3 (or 6) NAT rules :
http :

WAN incoming, TCP, port 80, redirect to IPv4 of your FIRST web server NAS IP, destination port 80.
WAN incoming, TCP, port 81, redirect to IPv4 of your SECOND web server NAS IP, destination port 80.
WAN incoming, TCP, port 81, redirect to IPv4 of your THIRD web server NAS IP, destination port 80.
https :
WAN incoming, TCP, port 443, redirect to IPv4 of your FIRST web server NAS IP, destination port 443.
WAN incoming, TCP port 444, redirect to IPv4 of your SECOND web server NAS IP, destination port 443.
WAN incoming, TCP port 445, redirect to IPv4 of your THIRD web server NAS IP, destination port 443.

Just a foot note : remember what Syno told you : Your NAS can do 'a web server' but it's not the one you should expose 'on the Internet'. It's meant be used in a controlled environment like your LAN.

So, there is a plan B :
Give everyone user a VPN access to your pfSense and it LAN(s). This doesn't mean the can access the GUI of pfSense, they still need the password, but from now on they can use the host name of your NAS(es) and connect to anything they want.
This is way safer.

slimypizza

Take a look at some online tutorials like this https://www.youtube.com/watch?v=bU85dgHSb2E.

I use HAproxy to access several local servers and network resources such as Plex, Emby, Bitwarden, Home Assistant on Rpi, home automation controller on micro computer, NAS calendar server, NAS drives, Synology Cloud, and my PFsense router via reverse proxies using for example a URL such as https://plex.mydomain.com. To go this route you need to own your domain (eg, mydomain.com) and direct queries to your router WAN IP. HAProxy can key on the “plex” subdomain and send the query to the correct internal IP and Port you set up on your backend (eg 192.168.1.44, port 32400). The only port you need to open up on the front end is 443 for the incoming https query. Good luck.

makeitso

@slimypizza said in I tried, I can't get it to work:

Take a look at some online tutorials like this https://www.youtube.com/watch?v=bU85dgHSb2E.

I use HAproxy to access several local servers and network resources such as Plex, Emby, Bitwarden, Home Assistant on Rpi, home automation controller on micro computer, NAS calendar server, NAS drives, Synology Cloud, and my PFsense router via reverse proxies using for example a URL such as https://plex.mydomain.com. To go this route you need to own your domain (eg, mydomain.com) and direct queries to your router WAN IP. HAProxy can key on the “plex” subdomain and send the query to the correct internal IP and Port you set up on your backend (eg 192.168.1.44, port 32400). The only port you need to open up on the front end is 443 for the incoming https query. Good luck.

I checked out this video, now it seems everything is working as far as the web interface goes. Now, I need to figure out the other services.

Thank you!
Jack

makeitso

@slimypizza I tried to quote your post and reply but something somewhere decided it was spam and would not let me post.

Anyway, I already have it working like that. I'm shooting for more secure. I am told having more ports open = less secure.

Thanks for the reply!
Jack

SteveITS

@makeitso I don’t use HAProxy, but you may want to post in https://forum.netgate.com/category/52/cache-proxy

makeitso

@SteveITS

Thanks for posting. I’ll Gibraltar that a look.

Jack

johnpoz

@makeitso said in I tried, I can't get it to work:

I am told having more ports open = less secure.

Where were you told this.. Yeah I wouldn't put my server in a dmz host type setup where all ports are open on it.

But having the same service to 3 different devices all running the same service - like 443, 444 and 445. I don't see how that applies here.

Assuming this service has the same security on all three - secure password, same version of the service, etc. Your exposing the same service - so don't really see how its less secure to have the service exposed 1 time vs 3 times. The exposed service is the problem, not that your running 2 other ones on some odd ball ports. Now if 1 used say public key auth, and the other(s) just used P@55word - then ok exposing those ones with the shitty password is less secure.

What exactly are you wanting to put behind haproxy? I have a service exposed, and letting it do the ssl offload. You also have to be using the exact fqdn to get to it - you can't just be randomly scanning ports.

edit: example

not the correct host headers, ie the fqdn you get this

root@localhost:~# openssl s_client -connect publicIP:443
CONNECTED(00000003)
40D784BE76720000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:../ssl/record/rec_layer_s3.c:1599:SSL alert number 112

If you use the actual host name.

root@localhost:~# openssl s_client -connect host.domain.tld:443
CONNECTED(00000003)
depth=3 C = US, O = Internet Security Research Group, CN = ISRG Root X2
verify return:1
depth=2 C = US, O = ISRG, CN = Root YE
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = YE1
verify return:1
depth=0 CN = domain.tld
verify return:1

It is still exposed, and yeah could be found - but if they are not using the actual fqdn, they don't get very far, and never actually can see the service behind the proxy.

makeitso

@johnpoz

It just makes sense to me that one open port is better than 3 open ports. All 3 use different ports, plus, I don’t need a certificate for each one because haproxy takes care of that. Since acme takes care of the certificates automatically, I don’t have to manually update the certificates every 3 months or so. Also, synology NAS devices need port 80 open to renew certificates if you want a useable cert to update automatically. This way, I access them without having to remember which port to use for each one. There will more in the future, not necessarily NAS devices. I figured this is the better option.

Thanks, Jack

johnpoz

@makeitso I am all for use of ha proxy - but you have given zero details of what exactly you are wanting to use through it. Its the dsm web gui? on port 5001? You sure and the hell are not going to get smb to work over the internet be a proxy or no proxy..

What service do you want to expose on your dsm through the proxy? Exposing the actual dsm admin gui is not a good idea.. If you want to get to your dsm(s) remotely use vpn, or just use their remote access method.

If you want to expose some web service your running on the nas, or some docker - that is pretty straight forward.. But since you have also not given any details of what you actually tried there is zero chance anyone can help you figure out what you are not doing correctly.

Clickly Clicky on my phone/laptop/tablet to connect to my vpn and I can access anything on my network - 1 port exposed.. And secure.. You would have to have the tls key before vpn server will even look at your attempt to login. And then you would need the cert, etc. etc..

Or use wireguard/tailscale.

Haproxy is a solution to certain things - but without knowing what those things are nobody can help walk you through how to set it up.. And again if you are wanting to expose the dsm web admin gui, I would highly suggest you not do that.

Hugovsky

@makeitso I have haproxy working. I'll try to explain my config. You need a certificate and a VIP and a pass rule in wan to the VIP and ports 80 and 443.

Check the images bellow and try to replicate the config with your data. ping for help.

makeitso

@johnpoz

Thank you for replying!

Specifically, I want to expose the web gui. Like I said, I want haproxy to handle the certificates.

I want to expose WebDAV, sftp and possibly carddav on only one of the NAS devices. I’m not sure if that’s realistic or not. I have ports exposed to enable those protocols but would rather have a few ports as possible. I have no intention to expose smb. If I wanted to do that, I would use a VPN. It would not be publicly available.

I believe I mention Nextcloud and mailcow in my first post.not sure those are possible either.. Nextcloud would be talk and the web interface, WebDAV, cardav and whatever it takes to make those work.

I have haproxy sort of working but not as well as I’d like.

I hope that clears it up a bit.

Thanks, Jack

makeitso

@Hugovsky

Wow, thanks for that! This will take me awhile to digest.

Thanks, Jack

johnpoz

@makeitso said in I tried, I can't get it to work:

I want to expose the web gui.

For what possible insane reason? Why would you think you need to expose the webgui? I just don't get it.. If you need to access the web gui use a vpn.. 1 Port, or just use their built in remote access - zero ports.

makeitso

@Hugovsky

I'm a newbie at this so bear with me please!

My first obstacle here is what would the VIP settings look like. Is it connected to the LAN. the WAN? I would assume the WAN. That might get me in trouble though. If I get this right, I might be able to stumble through the rest of it.

Thanks, Jack

EDIT

So, some more assumptions.

I think what you're doing there is on the frontend, one for http and one for https. I'm not sure what the http-to-https is doing.

The shared frontend it redirecting to the servers using "host matches". Also, I'm not sure if you created any rules to go along with any of this or not. It's a little confusing to me. I'm not that familiar with HAProxy or pfSense.

Thanks, Jack

Hugovsky

@makeitso You should never expose webgui to the web, Use ipsec or other VPN.

No need for another rules other than said before.

Here's my VIP settings:

Hugovsky

@makeitso said in I tried, I can't get it to work:

@johnpoz

Thank you for replying!

Specifically, I want to expose the web gui. Like I said, I want haproxy to handle the certificates.

I want to expose WebDAV, sftp and possibly carddav on only one of the NAS devices. I’m not sure if that’s realistic or not. I have ports exposed to enable those protocols but would rather have a few ports as possible. I have no intention to expose smb. If I wanted to do that, I would use a VPN. It would not be publicly available.

I believe I mention Nextcloud and mailcow in my first post.not sure those are possible either.. Nextcloud would be talk and the web interface, WebDAV, cardav and whatever it takes to make those work.

I have haproxy sort of working but not as well as I’d like.

I hope that clears it up a bit.

Thanks, Jack

To expose services, just use port foward. No need to use haproxy. That is for web servers

makeitso

So, I’ve decided to take everyone’s advice and not expose anything not totally necessary. I only really need to have one port opened for for one of the devices, not counting Nextcloud. Since I don’t have a web server, I’m getting rid on haproxy. I’ve never been able to get it to do what I want anyway, so why mess with it.

Anyway, a big thank you for everyone that contributed and changed my approach.

Thanks, Jack

johnpoz

@makeitso well kind of hard to drive in a nail with a screwdriver - ha proxy is a very flexible and useful proxy. But depending on the actual protocol no its not going to work.

Nextcloud is web based - you could for sure proxy that. And sure the dsm web gui as well.

Keep in mind depending on what your wanting to do - the proxy doesn't make sense, for example file transfer could take a serious hit on performance trying to proxy it through a low end routing device.

Ha proxy shines for ssl offload from my uses of it, and its easy enough to share a port and and send traffic to different backends based on the sni.

makeitso

@johnpoz
I had haproxy working for the NAS devices. Never got it to work with Nextcloud. I disabled haproxy and opened a few ports.

I only have ports open right now to let Nextcloud work. I might open a port so sftp can work. Beyond that, I think I can get by.

Thanks, Jack