HAProxy-devel config issue, help needed

jbiss_ca · Jan 2, 2015, 2:49 PM

Hello,

I'm using haproxy-devel 1.5.9 pkg v 0.15 on pfsense 2.2-RC (amd64) built on Fri Jan 02 05:25:48 CST 2015. Since I updated from the december 9th build which has updated HAproxy-devel to the newer version, my sites aren't working anymore. It seems that traffic is no longer forwarded to them based on the acl. I haven't changed my haproxy-devel config in quite some time so I'm wondering if new features or required settings have been introduced that I may be missing in my current config.

My sites are http://mirror.mydomain.com and **http://bbb.**mydomain.com so I had setup the ACLs to look for mirror and bbb respectively. That doesn't seem to work anymore. Any advice?

/var/etc/haproxy.cfg file contents:


global
	maxconn			1000
	log			/var/run/log	local0	debug
	stats socket /tmp/haproxy.socket level admin
	uid			80
	gid			80
	nbproc			1
	chroot			/tmp/haproxy_chroot
	daemon
	tune.ssl.default-dh-param	2048

frontend Mirror-merged
	bind			[wan-ip, IPv4]:80   <--removed my public IP
	mode			http
	log			global
	option			httplog
	option			http-keep-alive
	option			forwardfor
	acl https ssl_fc
	reqadd X-Forwarded-Proto:\ http if !https
	reqadd X-Forwarded-Proto:\ https if https
	maxconn			100
	timeout client		30000
	acl			0_mirror	hdr_beg(host) -i mirror
	use_backend		Storage1_http if 0_mirror 
	acl			1_bbb	hdr_beg(host) -i bbb
	use_backend		Observium_http if 1_bbb 

backend Storage1_http
	mode			http
	errorfile			503 /var/etc/haproxy/errorfile_Storage1_http_503_ExampleErrorfile
	balance			roundrobin
	timeout connect		30000
	timeout server		30000
	retries			3
	option			httpchk OPTIONS / 
	server			storage1 192.168.1.50:80 check inter 1000  weight 100 

backend Observium_http
	mode			http
	errorfile			503 /var/etc/haproxy/errorfile_Observium_http_503_ExampleErrorfile
	balance			roundrobin
	timeout connect		30000
	timeout server		30000
	retries			3
	option			httpchk OPTIONS / 
	server			observium 192.168.1.74:80 check inter 1000  weight 100

PiBa · Jan 2, 2015, 3:42 PM

Hi jbiss_ca,

The config itself seems to be ok, but a few things to check.

What exact error do you get in the browser, a 503 message or something else?
Could you configure the 'Internal stats port' on the settings tab, and then check in the 'Stats FS' if the backends are reported as 'up' ?

Just did a few small tests with the same 2.2 version your using and it seems to work OK for me.

Greets PiBa-NL

jbiss_ca · Jan 2, 2015, 10:03 PM

Hi PiBa,

I don't get any error code in my browser, simply the generic page not found error message.

I've enabled the 'Internal stats port' and on the 'Stats FS' page I see the backends (1 for each site) are up: L7OK/200 in 0ms. I have been keeping an eye on the 'Stats FS' page and noticed that some connections have made it to the backend server. I was able to load only twice a webpage throughout multiple refreshes. For the times that the page doesn't load and I get the generic page not found error message, the stats for the 'HAProxyLocalStats' are showing activity with the bytes in and out but on the front end named 'Mirror-merged' and both backends 'Storage1_http' and 'Observium_http' show no bytes in or out. It would appear to me that traffic is hitting my pfsense box and HAProxy but that it is only sometimes getting passed to the backend.

My configuration on the 'Backend' page for each site has the 'balanced' set to Round Robin. I only have one server for each site so is selecting Round Robin causing me issues by only sometimes passing traffic to the backend server?

Thanks for your help!

PiBa · Jan 2, 2015, 10:24 PM

Hi jbiss_ca,

So you don't see session and byte counters on the frontend increase at all? That would mean the connection never arrived at haproxy.

Do you have 1:1 natting or a portforward configured on pfSense for the wan-ip? Any floating rules / traffic shaping / other packages ?

Is there a lot of traffic or high cpu usage on pfSense ? It could be worth trying to make a tcpdump of the traffic to see if a incoming connection is answered. tcpdump can be started on a ssh/console with a command like this where you put the correct ip, and the interface name for em0:

tcpdump -i em0 "host 1.2.3.4 && port 80"

The TCP handshake go's like this normally: Request connection[ S] , Accept connection[ S.] , Traffic[ .] , that would be the first 3 packets..

As for logging to '/var/run/log' that sadly doesn't do much.. It would provide more information if you log it to a actual syslog server. Also enable the 'Detailed logging', every connection handled by haproxy should show up in those logs.

The roundrobbin selection shouldnt affect anything if only 1 server is available..

Hope some of it helps..