Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Haproxy-devel (0.27): tcp-request rule after reqadd rules

    Cache/Proxy
    2
    3
    1889
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      treuss last edited by

      Hi everyone,

      since our last update (to haproxy-devel 0.27), we're getting multiple warnings on applying haproxy-rules.

      
      [WARNING] 216/165751 (67472) : parsing [/var/etc/haproxy/haproxy.cfg:57] : a 'tcp-request' rule placed after a 'reqadd' rule will still be processed before
      ...
      [WARNING] 216/165751 (67472) : parsing [/var/etc/haproxy/haproxy.cfg:144] : a 'tcp-request' rule placed after a 'reqadd' rule will still be processed before. 
      
      

      Here's a snippet of our config:

      
      ...
      
      reqadd X-Forwarded-Proto:\ https if https
      reqadd X-Forwarded-Proto:\ http if !https
      
      stick-table type ip size 1m expire 30s store gpc0,http_req_rate(10s),conn_cur,conn_rate(3s)
      
      tcp-request connection accept if { src m.n.o.p }
      tcp-request connection accept if { src m.n.o.p }
      tcp-request connection accept if { src m.n.o.p }
      tcp-request connection accept if { src m.n.o.p }
      tcp-request connection accept if { src m.n.o.p }
      tcp-request connection accept if { src m.n.o.p }
      tcp-request connection accept if { src m.n.o.p }
      tcp-request connection accept if { src m.n.o.p }
      
      tcp-request connection track-sc1 src
      
      tcp-request connection reject if { src_get_gpc0(frontend) gt 10 }
      
      tcp-request connection reject if { src_conn_cur gt 40 }
      
      tcp-request connection reject if { src_conn_rate gt 40 }
      
      ...
      
      

      As you can see, these two reqadd X-Forwarded-Proto rules appear before the tcp-request rules and cause the warnings.

      My question is now: what settings add these reqadd X-Forwarded-Proto rules?
      Is there a way to skip these settings and instead add those rules manually into the Advanced pass thru field?

      Best regards
      Thomas

      1 Reply Last reply Reply Quote 0
      • P
        PiBa last edited by

        Its part of the "Use 'forwardfor' option" on the frontend. It creates rules like these:

        
        	option			forwardfor
        	acl https ssl_fc
        	reqadd X-Forwarded-Proto:\ http if !https
        	reqadd X-Forwarded-Proto:\ https if https
        
        

        Should be possible to add them in the advanced section.

        1 Reply Last reply Reply Quote 0
        • T
          treuss last edited by

          Thank you PiBa! It works like a charm!

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy