Using Haproxy as TCP frontend to Nginx (SSL), OpenVPN and OpenSSH. Timing out, no connectionHaProxy + IIS pages gradually get slowerHaProxy - Http and SSL pass through configHAProxy - ssl client ca chain cannot be verifiedHaproxy logging not workHA-Proxy 301 re-direct: https to https://wwwHaProxy giving - 503 Service UnavailableHAProxy not logging all requestsSASL auth to LDAP behind HAPROXY with name mismatchesHaProxy Frontend to Backend queuing and timeoutsopenldap with haproxy - (ldap_result() failed: Can't contact LDAP server)
Multi tool use
What is the thing used to help pouring liquids called?
How to use awk to extract data from a file based on the content of another file?
Is there a reason why Turkey took the Balkan territories of the Ottoman Empire, instead of Greece or another of the Balkan states?
What is monoid homomorphism exactly?
Installing Debian 10, upgrade to stable later?
In "Avengers: Endgame", what does this name refer to?
Debian 9 server no sshd in auth.log
What is more safe for browsing the web: PC or smartphone?
Subnumcases as a part of align
Does Thanos's ship land in the middle of the battlefield in "Avengers: Endgame"?
Referring to person by surname, keep or omit "von"?
Huffman Code in C++
All of my Firefox add-ons been disabled suddenly, how can I re-enable them?
Dual frame in Riemannian metrics.
Is throwing dice a stochastic or a deterministic process?
Dimmer switch not connected to ground
As a GM, is it bad form to ask for a moment to think when improvising?
Two denim hijabs
What does the copyright in a dissertation protect exactly?
Append unique characters read from filecontents to a string
Can an earth elemental drag a tiny creature underground with Earth Glide?
Collision domain question
Is crescere the correct word meaning to to grow or cultivate?
Hostile Divisor Numbers
Using Haproxy as TCP frontend to Nginx (SSL), OpenVPN and OpenSSH. Timing out, no connection
HaProxy + IIS pages gradually get slowerHaProxy - Http and SSL pass through configHAProxy - ssl client ca chain cannot be verifiedHaproxy logging not workHA-Proxy 301 re-direct: https to https://wwwHaProxy giving - 503 Service UnavailableHAProxy not logging all requestsSASL auth to LDAP behind HAPROXY with name mismatchesHaProxy Frontend to Backend queuing and timeoutsopenldap with haproxy - (ldap_result() failed: Can't contact LDAP server)
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
0
I'm trying to configure Haproxy to run on public port 443 and send TCP traffic to the right place as follow:
- 2 Nginx instances with SSL termination. Traffic router to either depending of hostname. All web traffic is over HTTPS.
- OpenVPN
- OpenSSH
I think my config is pretty close, but somehow I can't get it to work. My web requests just timeout.
What am I doing wrong?
global
log /dev/log local0 debug # TURN OFF DEBUG!
log /dev/log local1 notice
#log loghost local0 info
maxconn 1024
defaults
log global
mode http
option httplog
option dontlognull
option tcplog
retries 3
option redispatch
maxconn 2000
timeout connect 5000
timeout client 50000
timeout server 50000
listen HAProxy-Statistics
bind *:1936
mode http
option httplog
option httpclose
stats enable
stats uri /
stats refresh 10s
stats show-node
stats show-legends
stats show-desc Haproxy Frontend
stats auth admin:admin
frontend ssl_relay
bind 0.0.0.0:443 name frontend-ssl
mode tcp
option tcplog
option socket-stats
# option nolinger
maxconn 300
log /dev/log local0 debug # overkill! turn this off when not needed
tcp-request inspect-delay 5s
tcp-request content accept if req_ssl_hello_type 1
use_backend https_one if req_ssl_sni -i home.example.com
use_backend https_two if req_ssl_sni -i nc.example.com
use_backend openvpn if ! req.len 0
use_backend openssh if req.len 0
default_backend https_one
backend https_one
mode tcp
server home-https-server 10.0.0.4:4443 send-proxy
backend https_two
mode tcp
server nc-https-server 10.0.0.4:4444 send-proxy
backend openvpn
mode tcp
server openvpn-server 10.0.0.4:1194
backend openssh
mode tcp
server openssh-server 10.0.0.5:22
nginx ssl proxy haproxy tcp
asked Dec 7 '16 at 6:06
CarlCarl
1314
add a comment |
0
I'm trying to configure Haproxy to run on public port 443 and send TCP traffic to the right place as follow:
- 2 Nginx instances with SSL termination. Traffic router to either depending of hostname. All web traffic is over HTTPS.
- OpenVPN
- OpenSSH
I think my config is pretty close, but somehow I can't get it to work. My web requests just timeout.
What am I doing wrong?
global
log /dev/log local0 debug # TURN OFF DEBUG!
log /dev/log local1 notice
#log loghost local0 info
maxconn 1024
defaults
log global
mode http
option httplog
option dontlognull
option tcplog
retries 3
option redispatch
maxconn 2000
timeout connect 5000
timeout client 50000
timeout server 50000
listen HAProxy-Statistics
bind *:1936
mode http
option httplog
option httpclose
stats enable
stats uri /
stats refresh 10s
stats show-node
stats show-legends
stats show-desc Haproxy Frontend
stats auth admin:admin
frontend ssl_relay
bind 0.0.0.0:443 name frontend-ssl
mode tcp
option tcplog
option socket-stats
# option nolinger
maxconn 300
log /dev/log local0 debug # overkill! turn this off when not needed
tcp-request inspect-delay 5s
tcp-request content accept if req_ssl_hello_type 1
use_backend https_one if req_ssl_sni -i home.example.com
use_backend https_two if req_ssl_sni -i nc.example.com
use_backend openvpn if ! req.len 0
use_backend openssh if req.len 0
default_backend https_one
backend https_one
mode tcp
server home-https-server 10.0.0.4:4443 send-proxy
backend https_two
mode tcp
server nc-https-server 10.0.0.4:4444 send-proxy
backend openvpn
mode tcp
server openvpn-server 10.0.0.4:1194
backend openssh
mode tcp
server openssh-server 10.0.0.5:22
nginx ssl proxy haproxy tcp
asked Dec 7 '16 at 6:06
CarlCarl
1314
What do your haproxy debug logs say? Does the openVPN and ssh part work?
– Nath
Dec 7 '16 at 7:29
Where are the requests timing out? Can HA Proxy reach the web servers?
– varlogtim
Dec 7 '16 at 7:32
I'm not seeing anything in the logs, but I can see the request coming in in the stats panel, but not reaching a backed. The browser tells me the request times out.
– Carl
Dec 7 '16 at 14:34
If logging is actually working, but you get nothing logged, that's going to be outside of, and before, HAProxy -- firewalls, iptables. Verify logging and backend selection with a connection from inside the proxy:$ true | openssl s_client -connect 127.0.0.1:443 -servername <sni-hostname> -showcertsshould do the trick.
– Michael - sqlbot
Dec 8 '16 at 0:39
add a comment |
0
0
0
2
I'm trying to configure Haproxy to run on public port 443 and send TCP traffic to the right place as follow:
- 2 Nginx instances with SSL termination. Traffic router to either depending of hostname. All web traffic is over HTTPS.
- OpenVPN
- OpenSSH
I think my config is pretty close, but somehow I can't get it to work. My web requests just timeout.
What am I doing wrong?
global
log /dev/log local0 debug # TURN OFF DEBUG!
log /dev/log local1 notice
#log loghost local0 info
maxconn 1024
defaults
log global
mode http
option httplog
option dontlognull
option tcplog
retries 3
option redispatch
maxconn 2000
timeout connect 5000
timeout client 50000
timeout server 50000
listen HAProxy-Statistics
bind *:1936
mode http
option httplog
option httpclose
stats enable
stats uri /
stats refresh 10s
stats show-node
stats show-legends
stats show-desc Haproxy Frontend
stats auth admin:admin
frontend ssl_relay
bind 0.0.0.0:443 name frontend-ssl
mode tcp
option tcplog
option socket-stats
# option nolinger
maxconn 300
log /dev/log local0 debug # overkill! turn this off when not needed
tcp-request inspect-delay 5s
tcp-request content accept if req_ssl_hello_type 1
use_backend https_one if req_ssl_sni -i home.example.com
use_backend https_two if req_ssl_sni -i nc.example.com
use_backend openvpn if ! req.len 0
use_backend openssh if req.len 0
default_backend https_one
backend https_one
mode tcp
server home-https-server 10.0.0.4:4443 send-proxy
backend https_two
mode tcp
server nc-https-server 10.0.0.4:4444 send-proxy
backend openvpn
mode tcp
server openvpn-server 10.0.0.4:1194
backend openssh
mode tcp
server openssh-server 10.0.0.5:22
nginx ssl proxy haproxy tcp
asked Dec 7 '16 at 6:06
CarlCarl
1314
I'm trying to configure Haproxy to run on public port 443 and send TCP traffic to the right place as follow:
- 2 Nginx instances with SSL termination. Traffic router to either depending of hostname. All web traffic is over HTTPS.
- OpenVPN
- OpenSSH
I think my config is pretty close, but somehow I can't get it to work. My web requests just timeout.
What am I doing wrong?
global
log /dev/log local0 debug # TURN OFF DEBUG!
log /dev/log local1 notice
#log loghost local0 info
maxconn 1024
defaults
log global
mode http
option httplog
option dontlognull
option tcplog
retries 3
option redispatch
maxconn 2000
timeout connect 5000
timeout client 50000
timeout server 50000
listen HAProxy-Statistics
bind *:1936
mode http
option httplog
option httpclose
stats enable
stats uri /
stats refresh 10s
stats show-node
stats show-legends
stats show-desc Haproxy Frontend
stats auth admin:admin
frontend ssl_relay
bind 0.0.0.0:443 name frontend-ssl
mode tcp
option tcplog
option socket-stats
# option nolinger
maxconn 300
log /dev/log local0 debug # overkill! turn this off when not needed
tcp-request inspect-delay 5s
tcp-request content accept if req_ssl_hello_type 1
use_backend https_one if req_ssl_sni -i home.example.com
use_backend https_two if req_ssl_sni -i nc.example.com
use_backend openvpn if ! req.len 0
use_backend openssh if req.len 0
default_backend https_one
backend https_one
mode tcp
server home-https-server 10.0.0.4:4443 send-proxy
backend https_two
mode tcp
server nc-https-server 10.0.0.4:4444 send-proxy
backend openvpn
mode tcp
server openvpn-server 10.0.0.4:1194
backend openssh
mode tcp
server openssh-server 10.0.0.5:22
nginx ssl proxy haproxy tcp
nginx ssl proxy haproxy tcp
asked Dec 7 '16 at 6:06
CarlCarl
1314
asked Dec 7 '16 at 6:06
CarlCarl
1314
edited Dec 7 '16 at 17:46
Carl
asked Dec 7 '16 at 6:06
CarlCarl
1314
asked Dec 7 '16 at 6:06
CarlCarl
1314
asked Dec 7 '16 at 6:06
CarlCarl
1314
1314
What do your haproxy debug logs say? Does the openVPN and ssh part work?
– Nath
Dec 7 '16 at 7:29
Where are the requests timing out? Can HA Proxy reach the web servers?
– varlogtim
Dec 7 '16 at 7:32
I'm not seeing anything in the logs, but I can see the request coming in in the stats panel, but not reaching a backed. The browser tells me the request times out.
– Carl
Dec 7 '16 at 14:34
If logging is actually working, but you get nothing logged, that's going to be outside of, and before, HAProxy -- firewalls, iptables. Verify logging and backend selection with a connection from inside the proxy:$ true | openssl s_client -connect 127.0.0.1:443 -servername <sni-hostname> -showcertsshould do the trick.
– Michael - sqlbot
Dec 8 '16 at 0:39
add a comment |
What do your haproxy debug logs say? Does the openVPN and ssh part work?
– Nath
Dec 7 '16 at 7:29
Where are the requests timing out? Can HA Proxy reach the web servers?
– varlogtim
Dec 7 '16 at 7:32
I'm not seeing anything in the logs, but I can see the request coming in in the stats panel, but not reaching a backed. The browser tells me the request times out.
– Carl
Dec 7 '16 at 14:34
If logging is actually working, but you get nothing logged, that's going to be outside of, and before, HAProxy -- firewalls, iptables. Verify logging and backend selection with a connection from inside the proxy:$ true | openssl s_client -connect 127.0.0.1:443 -servername <sni-hostname> -showcertsshould do the trick.
– Michael - sqlbot
Dec 8 '16 at 0:39
What do your haproxy debug logs say? Does the openVPN and ssh part work?
– Nath
Dec 7 '16 at 7:29
What do your haproxy debug logs say? Does the openVPN and ssh part work?
– Nath
Dec 7 '16 at 7:29
Where are the requests timing out? Can HA Proxy reach the web servers?
– varlogtim
Dec 7 '16 at 7:32
Where are the requests timing out? Can HA Proxy reach the web servers?
– varlogtim
Dec 7 '16 at 7:32
I'm not seeing anything in the logs, but I can see the request coming in in the stats panel, but not reaching a backed. The browser tells me the request times out.
– Carl
Dec 7 '16 at 14:34
I'm not seeing anything in the logs, but I can see the request coming in in the stats panel, but not reaching a backed. The browser tells me the request times out.
– Carl
Dec 7 '16 at 14:34
If logging is actually working, but you get nothing logged, that's going to be outside of, and before, HAProxy -- firewalls, iptables. Verify logging and backend selection with a connection from inside the proxy:
$ true | openssl s_client -connect 127.0.0.1:443 -servername <sni-hostname> -showcerts should do the trick.– Michael - sqlbot
Dec 8 '16 at 0:39
If logging is actually working, but you get nothing logged, that's going to be outside of, and before, HAProxy -- firewalls, iptables. Verify logging and backend selection with a connection from inside the proxy:
$ true | openssl s_client -connect 127.0.0.1:443 -servername <sni-hostname> -showcerts should do the trick.– Michael - sqlbot
Dec 8 '16 at 0:39
add a comment |
1 Answer
1
active
oldest
votes
0
Speaking about OpenVPN, I came to the conclusion that putting it behind is counterproductive.
- You won't have a permanent session and if the backend dies and you were connected to that backend, you still need to reconnect.
- OpenVPN comes with an easy to use load-balancing/failover option (I am not sure if it even reconnects automatically when one server fails):
remote server1.mydomain
remote server2.mydomain
remote server3.mydomain
remote-random
- HAProxy forces you to use TCP instead of UDP, which means that you do packet hand-shakes twice: for the tunnel, and for the package encapsulated in the tunnel.
answered Apr 27 at 20:41
maxadamomaxadamo
1513
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f819206%2fusing-haproxy-as-tcp-frontend-to-nginx-ssl-openvpn-and-openssh-timing-out-n%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
Speaking about OpenVPN, I came to the conclusion that putting it behind is counterproductive.
- You won't have a permanent session and if the backend dies and you were connected to that backend, you still need to reconnect.
- OpenVPN comes with an easy to use load-balancing/failover option (I am not sure if it even reconnects automatically when one server fails):
remote server1.mydomain
remote server2.mydomain
remote server3.mydomain
remote-random
- HAProxy forces you to use TCP instead of UDP, which means that you do packet hand-shakes twice: for the tunnel, and for the package encapsulated in the tunnel.
answered Apr 27 at 20:41
maxadamomaxadamo
1513
add a comment |
0
Speaking about OpenVPN, I came to the conclusion that putting it behind is counterproductive.
- You won't have a permanent session and if the backend dies and you were connected to that backend, you still need to reconnect.
- OpenVPN comes with an easy to use load-balancing/failover option (I am not sure if it even reconnects automatically when one server fails):
remote server1.mydomain
remote server2.mydomain
remote server3.mydomain
remote-random
- HAProxy forces you to use TCP instead of UDP, which means that you do packet hand-shakes twice: for the tunnel, and for the package encapsulated in the tunnel.
answered Apr 27 at 20:41
maxadamomaxadamo
1513
add a comment |
0
0
0
Speaking about OpenVPN, I came to the conclusion that putting it behind is counterproductive.
- You won't have a permanent session and if the backend dies and you were connected to that backend, you still need to reconnect.
- OpenVPN comes with an easy to use load-balancing/failover option (I am not sure if it even reconnects automatically when one server fails):
remote server1.mydomain
remote server2.mydomain
remote server3.mydomain
remote-random
- HAProxy forces you to use TCP instead of UDP, which means that you do packet hand-shakes twice: for the tunnel, and for the package encapsulated in the tunnel.
answered Apr 27 at 20:41
maxadamomaxadamo
1513
Speaking about OpenVPN, I came to the conclusion that putting it behind is counterproductive.
- You won't have a permanent session and if the backend dies and you were connected to that backend, you still need to reconnect.
- OpenVPN comes with an easy to use load-balancing/failover option (I am not sure if it even reconnects automatically when one server fails):
remote server1.mydomain
remote server2.mydomain
remote server3.mydomain
remote-random
- HAProxy forces you to use TCP instead of UDP, which means that you do packet hand-shakes twice: for the tunnel, and for the package encapsulated in the tunnel.
answered Apr 27 at 20:41
maxadamomaxadamo
1513
answered Apr 27 at 20:41
maxadamomaxadamo
1513
answered Apr 27 at 20:41
maxadamomaxadamo
1513
answered Apr 27 at 20:41
maxadamomaxadamo
1513
1513
add a comment |
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f819206%2fusing-haproxy-as-tcp-frontend-to-nginx-ssl-openvpn-and-openssh-timing-out-n%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
E85Zsl HeSyhOJH 5PTIJj3F1x,4 bK
What do your haproxy debug logs say? Does the openVPN and ssh part work?
– Nath
Dec 7 '16 at 7:29
Where are the requests timing out? Can HA Proxy reach the web servers?
– varlogtim
Dec 7 '16 at 7:32
I'm not seeing anything in the logs, but I can see the request coming in in the stats panel, but not reaching a backed. The browser tells me the request times out.
– Carl
Dec 7 '16 at 14:34
If logging is actually working, but you get nothing logged, that's going to be outside of, and before, HAProxy -- firewalls, iptables. Verify logging and backend selection with a connection from inside the proxy:
$ true | openssl s_client -connect 127.0.0.1:443 -servername <sni-hostname> -showcertsshould do the trick.– Michael - sqlbot
Dec 8 '16 at 0:39