• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Inbound Failover for HTTPS

Scheduled Pinned Locked Moved Routing and Multi WAN
23 Posts 2 Posters 9.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    skipper
    last edited by Mar 9, 2012, 2:26 PM

    Hi Folks,

    is it possible to have a failover for https requests on pfsense (2.0-RELEASE (amd64)? Which tool should i use?

    I set up the load balancer (which exists by default) on pfsense but the problem is that the https requests are hopping from web1 to web2 and vice versa. Even with the sticky connection option is behaving the same :/

    I tried HAproxy but there i had another problem. When i configure the haproxy for http then the http request is going to web1 (or web2) and it's being redirected to https (as the servers are configured to redirect http to https) and the client receives an SSL Connection Error. If i send directly an https request then i have the same result.
    When I configure the haproxy for https then the requests are not even reaching one of the 2 servers, and i can also not access the stats.
    for configuring the haproxy i followed this http://forum.pfsense.org/index.php/topic,21748.0.html and this http://conheotiensinh.blogspot.com/2011/12/config-haproxy-with-pfsense-version-201.html

    I want to set a failover for my webservers. I want all HTTPS requests to go to web1 and in case web1 is down then the traffic to be (re)directed to web2. is that possible with pfSense?

    thnx in advance

    1 Reply Last reply Reply Quote 0
    • M
      marcelloc
      last edited by Mar 9, 2012, 2:33 PM

      I use haproxy for https failover without issues.

      what version of haproxy are you using?

      The pfsense loadbalancer(relayd) is also usefull for https failover.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • S
        skipper
        last edited by Mar 9, 2012, 3:10 PM

        hi marcelloc,

        how can i use pfsense loadbalancer for failover, there is just loadbalancing and manual failover mode. I want all requests to go to web1 and just if web1 is down then the https requests go to web2. is that possible? i followed this howto http://www.howtoforge.com/how-to-use-pfsense-to-load-balance-your-web-servers

        i tried with haproxy (haproxy-legacy 1.4.19 pkg v 1.0) following this howto http://conheotiensinh.blogspot.com/2011/12/config-haproxy-with-pfsense-version-201.html but since my webservers are redirecting http to https i was getting an ssl error.

        1 Reply Last reply Reply Quote 0
        • M
          marcelloc
          last edited by Mar 9, 2012, 4:02 PM

          @skipper:

          how can i use pfsense loadbalancer for failover, there is just loadbalancing and manual failover mode. I want all requests to go to web1 and just if web1 is down then the https requests go to web2. is that possible? i followed this howto http://www.howtoforge.com/how-to-use-pfsense-to-load-balance-your-web-servers

          If you do not want to use manual failover, you can create a pool for each server and setup  Virtual Server with Virtual Server Pool for the first server and Fall Back Pool for the second

          @skipper:

          i tried with haproxy (haproxy-legacy 1.4.19 pkg v 1.0) following this howto http://conheotiensinh.blogspot.com/2011/12/config-haproxy-with-pfsense-version-201.html but since my webservers are redirecting http to https i was getting an ssl error.

          If you have both http and https going to the same server, this should be transparent.
          Did you selected Source as a balance method on your haproxy frontends?

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • S
            skipper
            last edited by Mar 9, 2012, 4:14 PM

            thnx for the fast reply man!!

            how can i create the Fall Back Pool??
            i am creating a pool with the just web1 on it and then a second pool with just the web2? is this what u mean?

            1 Reply Last reply Reply Quote 0
            • S
              skipper
              last edited by Mar 9, 2012, 4:28 PM

              I think i got what you mean :)
              hope that will work  8)

              thnx a lot!!

              1 Reply Last reply Reply Quote 0
              • S
                skipper
                last edited by Mar 12, 2012, 12:14 PM

                i tried it and it seems that it's working!

                however, the redirection is very slow,

                when i take apache down on web1 then from loadbalncer status i can see that the pool with the web1 is down and the pool with the web2 is up (green). however, the loadbalancer is still forwarding the http(s) requests to web1 for some minutes, and then after 2,3 minutes it switching to web2  ???

                is there a way to improve this and make it faster so it will not take so long?

                thnx

                1 Reply Last reply Reply Quote 0
                • M
                  marcelloc
                  last edited by Mar 12, 2012, 12:23 PM

                  Are you getting errors from client access or just seeing some traffic going(heath status check from firewall for example) to down server?

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • S
                    skipper
                    last edited by Mar 12, 2012, 12:34 PM

                    from the client side i cannot access the web (This webpage is not available) and on the FW i can see that the requests are going to web1 even if the load balancer recognizes that it is down. After 2 or 3 minutes is redirecting the traffic to web2.

                    1 Reply Last reply Reply Quote 0
                    • M
                      marcelloc
                      last edited by Mar 12, 2012, 12:39 PM

                      Did you tried the manual failover or haproxy before this fallback pool?

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • S
                        skipper
                        last edited by Mar 12, 2012, 12:48 PM

                        thnx for your time and help marcelloc

                        yes i tried them,
                        the manual failover cannot do what i need, because i want the traffic to be forwarded automatically to web2 when web1 is down.
                        and haproxy didn't look to work for https traffic, thus i chose to stay at loadbalancer solution, just i need to improve the time that it takes for forwarding the requests to web2 when web1 is down.
                        isn't it there a way to make it faster?
                        the point is that the load balancer is recognizing very fast that the web1 is down, is just not changing the forwarding to web2.

                        1 Reply Last reply Reply Quote 0
                        • M
                          marcelloc
                          last edited by Mar 12, 2012, 12:52 PM

                          Well, I use haproxy for https as I told you with no issues.

                          Can you try haproxy again using source as balance method, one pool for http and another pool for https?

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • S
                            skipper
                            last edited by Mar 12, 2012, 1:02 PM

                            yeah i will give it a try with haproxy (legacy) again and see if it can work.

                            when i tried i used a virtual carp IP (internet IP) and there i could also access the stats, but i didn't like that the stats were accessible from internet.
                            is it possible to access the stats (and setup haproxy) in another IP and not in the external IP of haproxy?

                            1 Reply Last reply Reply Quote 0
                            • M
                              marcelloc
                              last edited by Mar 12, 2012, 1:07 PM

                              I enable stats on internal pools only. Any stat page show stats for all pools.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • S
                                skipper
                                last edited by Mar 12, 2012, 3:01 PM

                                haproxy doesn't seem to be working for me :/ it's not even forwarding the requests to web1 or web2, i don't know what i am doing wrong there  :-[

                                furthermore, after some tries to edit the configuration for the frontend is accepting the changes but is not updating the configuration, it seems like there is a bug in haproxy legacy (at least 2.0-RELEASE (amd64)).

                                as for the load balancer what i noticed is that when i take web1 down i can see from the pool tab that web1 is down (red) but on the virtual server tab it keeps "targeting" (forwarding) the requests to web1, which means that the virtual server is not refreshing the status right after the pool.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  marcelloc
                                  last edited by Mar 12, 2012, 3:08 PM

                                  Can you screenshot your haproxy config?

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    skipper
                                    last edited by Mar 12, 2012, 3:32 PM

                                    here it's my configuration of haproxy…what am i doing wrong ???

                                    the virtual IP is on the wan interface and it's CARP.
                                    when the client is sending https request is not getting any answer
                                    with http requests is going to pfsense web interface.

                                    thnx once again man!!

                                    listener1.png
                                    listener1.png_thumb
                                    listener2.png
                                    listener2.png_thumb
                                    listener3.png
                                    listener3.png_thumb
                                    pool1.png
                                    pool1.png_thumb
                                    pool2.png
                                    pool2.png_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      marcelloc
                                      last edited by Mar 12, 2012, 3:38 PM

                                      Can you try this setup with legacy package?

                                      I'm using it, so it will be easier to me to compare my setup with yours.

                                      This week I`ll rename haproxy-lagacy to haproxy-full as it has more options then current 1.2 package.

                                      Both(1.2 and 1.0) use the same 1.4.19 version of haproxy.

                                      att,
                                      Marcello Coutinho

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        skipper
                                        last edited by Mar 12, 2012, 3:55 PM

                                        i removed haproxy and installed haproxy legacy and then i configured it again.
                                        the results are same as before :/
                                        here is my configuration…

                                        frontend1.png
                                        frontend1.png_thumb
                                        frontend2.png
                                        frontend2.png_thumb
                                        frontend3.png
                                        frontend3.png_thumb
                                        backend1.png
                                        backend1.png_thumb
                                        backend2.png
                                        backend2.png_thumb

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          marcelloc
                                          last edited by Mar 12, 2012, 7:06 PM

                                          On backends I do not fill up Advanced pass thru and do not set cookies on Servers.

                                          The other settings looks similar here.

                                          Enable stats and try to see what happens.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          1 out of 23
                                          • First post
                                            1/23
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received