# 1 Public IP 2 webservers ports 80/443 how to?

**URL:** <https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259>\
**Category:** Help!\
**Created:** [August 31, 2019, 7:41am UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259 "2019-08-31T07:41:23Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![dayfly](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dayfly](https://discourse.haproxy.org/u/dayfly)\
**Post date:** [August 31, 2019, 7:41am UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/1 "2019-08-31T07:41:23Z")

</div>

I am trying to setup haproxy with ubuntu 18 but cant figure out how to set everyting up.

I want to use internal 2 servers with 1 public IP, both servers use ports 80 and 443 and have their own subdomain.

Situation  
1 Exchange 2016 server [exchage.domain.com](http://exchage.domain.com) internal IP 192.168.1.10  
1 Ubuntu nextcloud server [nextcloud.domain.com](http://nextcloud.domain.com) internal IP 192.168.1.5  
1 ubuntu server with HAProxy installed IP 192.168.1.2  
1 Router IP 192.168.1.1

Both servers (exchange and nextcloud) have ssl certs that auto renew from lets encypt and both servers need port 80 and 443 open.

How can i setup HAProxy that trafic for the exchange server and nextcloud server is deliverd to to correct exchange and nextcloud servers ?

---

<div class="post-metadata">

**Author:** ![dayfly](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dayfly](https://discourse.haproxy.org/u/dayfly)\
**Post date:** [August 31, 2019, 4:42pm UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/2 "2019-08-31T16:42:33Z")

</div>

i managed to get it working with this

frontend exchange  
bind 192.168.1.2:443 name https  
default\_backend exchange\_servers

backend exchange\_servers  
server exchangesrv.domain.nl 192.168.1.10 check port 443  
server nextcloud.domain.nl 192.168.1.5 check port 443

1 problem the exchange server is using the cert from the nextcloud, how can i change it that every server uses its own certificate ?  
Now i get a certificate error on my exchange server.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [September 1, 2019, 2:10pm UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/3 "2019-09-01T14:10:53Z")

</div>

That’s wrong. You configured haproxy to load-balance between 2 different servers.

You need to content switch on port 80 based on the Host header (in HTTP mode) and on port 443 based on the SNI value (in TCP mode), something like:

```
frontend http
 mode http
 bind :80
 use_backend exchangesrv_http if { hdr(Host) -i exchangesrv.domain.nl }
 use_backend nextcloud_http if { hdr(Host) -i nextcloud.domain.nl }

backend exchangesrv_http
 mode http
 server exchangesrv 192.168.1.10:80

backend nextcloud_http
 mode http
 server nextcloud 192.168.1.5:80

frontend https
 mode tcp
 bind :443 name https
 tcp-request inspect-delay 5s
 tcp-request content accept if { req_ssl_hello_type 1 }
 use_backend exchangesrv_https if { req_ssl_sni -i exchangesrv.domain.nl }
 use_backend nextcloud_https if { req_ssl_sni -i nextcloud.domain.nl }

backend exchangesrv_https
 mode tcp
 server exchangesrv 192.168.1.10:443

backend nextcloud_https
 mode tcp
 server nextcloud 192.168.1.5:443

```

Also make sure the certificates don’t overlap (not wildcard or SANs covering the other hostname), otherwise browser will try to reuse a connection that is pointing to the wrong server.

Also see:

> **[Web Application Name to Backend Mapping in HAProxy - HAProxy Technologies](https://www.haproxy.com/blog/web-application-name-to-backend-mapping-in-haproxy/)**
>
> Synopsis Let’s take a web application platform where many HTTP Host header points to. Of course, this platform hosts many backends and HAProxy is used to perform content switching based on the Host header to route HTTP traffic to each backend....

  

> **[Enhanced SSL Load Balancing with Server Name Indication (SNI) TLS Extension -...](https://www.haproxy.com/blog/enhanced-ssl-load-balancing-with-server-name-indication-sni-tls-extension/)**
>
> Synopsis Some time ago, we wrote an article which explained how to load-balance SSL services, maintaining affinity using the SSLID. The main limitation of this kind of architecture is that you must dedicate a public IP address and port per service....

---

<div class="post-metadata">

**Author:** ![dayfly](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dayfly](https://discourse.haproxy.org/u/dayfly)\
**Post date:** [September 1, 2019, 4:39pm UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/4 "2019-09-01T16:39:10Z")

</div>

> [@lukastribus](#):
>
> SAN

Thank you very much!, the certificate error is fixed, now both servers get the right certificate.  
the exchange and nextcloud server get their own certificate from lets encrypt.

Only one small problem left, my outlook clients keep asking me for a password, it works a few seconds then disconnects.  
On my iphone mail from exchange works with no problems, also owa/webmail works good, its the office outlook that keeps asking for password.

do you know what that could be ?  
here is part of my logs, i am unsure if there is anything wrong in it.

Sep 1 16:33:34 haproxy haproxy[1161]: 192.168.1.1:55289 [01/Sep/2019:16:33:34.382] http http/ -1/-1/-1/-1/0 503 213 - - SC-- 5/1/0/0/0 0/0 “GET /autodiscover/autodiscover.xml HTTP/1.1”  
Sep 1 16:33:34 haproxy haproxy[1161]: 192.168.1.1:55290 [01/Sep/2019:16:33:34.388] http http/ -1/-1/-1/-1/0 503 213 - - SC-- 5/1/0/0/0 0/0 “GET /autodiscover/autodiscover.xml HTTP/1.1”  
Sep 1 16:33:42 haproxy haproxy[1161]: 192.168.1.1:55292 [01/Sep/2019:16:33:42.892] https https/ -1/-1/0 0 SC 6/6/0/0/0 0/0  
Sep 1 16:33:42 haproxy haproxy[1161]: 192.168.1.1:55293 [01/Sep/2019:16:33:42.892] https https/ -1/-1/0 0 SC 5/5/0/0/0 0/0  
Sep 1 16:33:51 haproxy haproxy[1161]: 192.168.1.1:55079 [01/Sep/2019:16:29:29.670] https remote\_https/remote 1/0/261770 28368 CD 4/4/3/3/0 0/0  
Sep 1 16:33:51 haproxy haproxy[1161]: 192.168.1.1:55094 [01/Sep/2019:16:29:30.910] https remote\_https/remote 1/0/260588 2368 CD 3/3/2/2/0 0/0

---

<div class="post-metadata">

**Author:** ![dayfly](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dayfly](https://discourse.haproxy.org/u/dayfly)\
**Post date:** [September 2, 2019, 4:20pm UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/5 "2019-09-02T16:20:20Z")

</div>

Is there anyone who has this working?

i have been reading for hours but i cant find a solution, only one but that was mac related, i also tried that with no luck.

the moment i forward port 443 back to the exchange server it works perfect again, so i think its a config somewhere in Haproxy, but where?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [September 2, 2019, 4:56pm UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/6 "2019-09-02T16:56:51Z")

</div>

> [@dayfly](#):
>
> ```
> Sep 1 16:33:34 haproxy haproxy[1161]: 192.168.1.1:55289 [01/Sep/2019:16:33:34.382] http http/ -1/-1/-1/-1/0 503 213 - - SC-- 5/1/0/0/0 0/0 “GET /autodiscover/autodiscover.xml HTTP/1.1”
> Sep 1 16:33:34 haproxy haproxy[1161]: 192.168.1.1:55290 [01/Sep/2019:16:33:34.388] http http/ -1/-1/-1/-1/0 503 213 - - SC-- 5/1/0/0/0 0/0 “GET /autodiscover/autodiscover.xml HTTP/1.1”
> 
> ```

This means haproxy cannot reach the exchange server on port 80.

Please provide the output of:

`curl -v "http://192.168.1.10:80/autodiscover/autodiscover.xml"`

from the haproxy instance. You may have a firewall issue or something like that, not allowing HTTP traffic towards this. Or maybe you just need to configure the client to use HTTPS instead.

edit: you can try redirecting to HTTPS if your exchange instance doesn’t provide HTTP, remove:

```
use_backend exchangesrv_http if { hdr(Host) -i exchangesrv.domain.nl }

```

and add (only in the http frontend):

```
redirect scheme https if { hdr(Host) -i exchangesrv.domain.nl }

```

---

<div class="post-metadata">

**Author:** ![dayfly](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dayfly](https://discourse.haproxy.org/u/dayfly)\
**Post date:** [September 2, 2019, 6:39pm UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/7 "2019-09-02T18:39:36Z")

</div>

Output from curl -v “[http://192.168.1.10:80/autodiscover/autodiscover.xml](http://192.168.1.10:80/autodiscover/autodiscover.xml)”

admin@haproxy:~$ curl -v [http://192.168.1.10:80/autodiscover/autodiscover.xml](http://192.168.1.10:80/autodiscover/autodiscover.xml)

- Trying 192.168.1.10…
- TCP\_NODELAY set
- Connected to 192.168.1.10 (192.168.1.10) port 80 (#0)

> GET /autodiscover/autodiscover.xml HTTP/1.1  
> Host: 192.168.1.10  
> User-Agent: curl/7.58.0  
> Accept: _/_

\< HTTP/1.1 401 Unauthorized  
\< Server: Microsoft-IIS/10.0  
\< request-id: 0e8aa857-5983-462c-b20b-185f3b61909c  
\< X-SOAP-Enabled: True  
\< X-WSSecurity-Enabled: True  
\< X-WSSecurity-For: None  
\< X-OAuth-Enabled: True  
\< WWW-Authenticate: Basic realm=“192.168.1.10”  
\< WWW-Authenticate: Negotiate  
\< WWW-Authenticate: NTLM  
\< X-Powered-By: [ASP.NET](http://ASP.NET)  
\< X-FEServer: SRV1  
\< Date: Mon, 02 Sep 2019 18:29:59 GMT  
\< Content-Length: 0  
\<

- Connection #0 to host 192.168.1.10 left intact

I tried changing the redirecting to HTTPS like you suggested but also no result, the moment i start outlook it works for 5 seconds, then it keeps requesting for a password.

Once i switch back the open port 443 to IP 192.168.1.10 it works again.

i am still trying to disable my firewall but that isnt so easy on a USG Ubiquity is see

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [September 2, 2019, 7:07pm UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/8 "2019-09-02T19:07:48Z")

</div>

curl works, so either haproxy itself is misconfigured, or your local OS has some kind of firewall.

> [@dayfly](#):
>
> i am still trying to disable my firewall but that isnt so easy on a USG Ubiquity is see

Unless that firewall is between haproxy and your exchange server, its should be irrelevant.

---

<div class="post-metadata">

**Author:** ![dayfly](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dayfly](https://discourse.haproxy.org/u/dayfly)\
**Post date:** [September 3, 2019, 11:57am UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/9 "2019-09-03T11:57:05Z")

</div>

I am lost, tried everything, even reinstalled HAPProxy on a fresh ubuntu server, cant really do anything wrong with the installation.  
Disabled the local firewall from the windows exchange 2016 server  
Changed IP from the HAProxy.  
Outlook 2016 keeps asking for a password, strange thing is that it is a login screen from 365 and not my own server.  
i use EOP so my MX record is forwarded to 0 [mydomain-nl.mail.protection.outlook.com](http://mydomain-nl.mail.protection.outlook.com).

# global

```
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # Default ciphers to use on SSL-enabled listening sockets.
    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA$
    ssl-default-bind-options no-sslv3

```

# defaults

```
    log global
    mode http
    option httplog
    option dontlognull
    timeout connect 5000
    timeout client 50000
    timeout server 50000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http

```

# frontend http

mode http  
bind :80  
stats hide-version  
stats refresh 30s  
stats show-node  
stats auth admin:password  
stats uri /haproxy?stats

redirect scheme https if { hdr(Host) -i remote.domein.nl }  
use\_backend cloud\_http if { hdr(Host) -i cloud.domein.nl }

# backend remote\_http

mode http  
server remote 192.168.1.10:80

# backend cloud\_http

mode http  
server cloud 192.168.1.5:80

# frontend https

mode tcp  
bind :443 name https  
tcp-request inspect-delay 5s  
tcp-request content accept if { req\_ssl\_hello\_type 1 }  
use\_backend remote\_https if { req\_ssl\_sni -i remote.domain.nl }  
use\_backend cloud\_https if { req\_ssl\_sni -i cloud.domein.nl }

# backend remote\_https

mode tcp  
server remote 192.168.1.10:443

# backend cloud\_https

mode tcp  
server cloud 192.168.1.5:443

---

<div class="post-metadata">

**Author:** ![dayfly](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dayfly](https://discourse.haproxy.org/u/dayfly)\
**Post date:** [September 8, 2019, 6:38am UTC](https://discourse.haproxy.org/t/1-public-ip-2-webservers-ports-80-443-how-to/4259/10 "2019-09-08T06:38:58Z")

</div>

Update,

Moving from Hyper-V to VMware solved the problem.

i also had to put autodiscover in the config no idea why, but it works perfect now.