Hi and thanks for your ongoing support. In the meantime I was not lazy. Believe me I now tried everthing to get my backend server online (in Edge and Chrome).
Let me add some details which may be important. I’m running HAproxy on my Linux firewall IPFire. Port 80 and 443 are open, the firewall has the IP-address 172.17.0.2, hence those binding to port 80 and 443 to this address in my config.
The backend server in question cannot be accessed from internet so HAProxy shoild be the solution to redirect the subdomain drive.mydomain.de to the backend, which has got the IP-address 192.168.6.97 and port 10002 (port 80 is reserved hence this custom port). The webserver serving port 10002 is nginx and is not configured for https nor does it have any certification attached. This should be the part of HAproxy.
Here ist the output of (shortend)
curl -vv http://192.168.6.97:10002/
* Trying 192.168.6.97:10002...
* Connected to 192.168.6.97 (192.168.6.97) port 10002 (#0)
> GET / HTTP/1.1
> Host: 192.168.6.97:10002
> User-Agent: curl/7.73.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx
< Date: Sat, 22 May 2021 12:32:20 GMT
< Content-Type: text/html; charset="UTF-8"
< Transfer-Encoding: chunked
< Connection: keep-alive
< Keep-Alive: timeout=20
< Vary: Accept-Encoding
< Cache-control: no-store
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< X-Frame-Options: SAMEORIGIN
< P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
< Content-Security-Policy: base-uri 'self'; connect-src ws: wss: *; default-src 'self' 'unsafe-eval' data: blob: https://*.synology.com https://www.synology.cn/; font-src 'self' data: https://*.googleapis.com https://*.gstatic.com; form-action 'self'; frame-ancestors 'self' https://gofile.me http://gofile.me; frame-src 'self' data: blob: https://*.synology.com https://www.synology.cn/ http://*.synology.com http://*.synology.cn; img-src 'self' data: blob: https://*.google.com https://*.googleapis.com http://*.googlecode.com https://*.gstatic.com; media-src 'self' data: about:; script-src 'self' 'unsafe-eval' data: blob: https://*.synology.com https://www.synology.cn/ https://*.google.com https://*.googleapis.com; style-src 'self' 'unsafe-inline' https://*.googleapis.com;
< Set-Cookie: id=;expires=Thu, 01-Jan-1970 00:00:01 GMT;path=/
<
<!DOCTYPE html>
<html>
<head>
Here ist the output of (shortend)
curl -vv https://192.168.6.97:10002/
* Trying 192.168.6.97:10002...
* Connected to 192.168.6.97 (192.168.6.97) port 10002 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-bundle.crt
* CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
Above error obviously occurs because of the server not being configured for any https request.
I continued and followed your advice and started over, using a smart and simple basic config with a port 80 binding.
global
log 127.0.0.1 local1
defaults
log global
option httplog
frontend http_https
bind 172.17.0.2:80
default_backend server
backend server
server synodrive01 192.168.6.97:10002
Using Firefox to access http://drive.mydomain.de works although the browser compains about an insecure connection.
Using Edge still using http, this, too works with the same security warning.
So basically a connection is possible, IMO. OTH both browsers cannot access the backend when using https protocol, this was expected, though.
Next step, I chenged config and added a binding for port 443, w/o any certifications.
global
log 127.0.0.1 local1
defaults
log global
option httplog
frontend http_https
bind 172.17.0.2:443
default_backend server
backend server
server synodrive01 192.168.6.97:10002
Neither Firefox nor Edge is able to reach the server using http protocol - this is OK!
Using https access, Firefox errors out, giving me the message SSL_ERROR_RX_RECORD_TOO_LONG.
Edge browser answered slightly different: ERR_SSL_PROTOCOL_ERROR
Guess both errors are due to not using any cert for SSL right now. Hence I’m changed the config file, adding a directory where the Let’s Encrypt certifications are saved.
bind 172.17.0.2:443 ssl crt /etc/haproxy/certs/
Using Firefox https://drive.mydomain.de works like a charm, no issues.
Using Edge to access the URL, it gave me the error ERR_EMPTY_RESPONSE and neither the console nor any other debug message in Edge’s dev environment did show any hint about this error.
At the time of this error I retried curl in a shell of my firewall and still got the same correct answer and html source like above.
curl -vv https://drive.mydomain.de
FWIW, I always restarted each browser (in private mode) before retrying again and again.
I continued and added mode http to the default section.
Now, Edge answered with a
502 Bad Gateway
while Firefox continued to work properly.
At this time I’m stuck with ideas to continue testing. No chance to get this running and to add, I’m running some more backend on different OS, e.g. Raspberry PI and Synology NAS using Docker containers and even native apps on Synology.
No matter which one I’m trying to access in Edge, any backend reacts similar to the experiences I made above, Chrome follows exactly (because of the same enging underneath?) while Firefox works flawlessly.
So do you still have the time and patience to read and answer? I’m certainly not that network expert nor HAproxy at all, however, this now basic setup should be simple enough to reach any of those backend servers via HAProxy, shouldn’t it.
My subdomains like drive.mydomain.de are configured to use CNAMEs, btw, if this matters.
Thank you very much for reading again and again,
Michael
WOW - YOU ARE GENIUS! 