Thanks for Clarification however I’m not sure what I’ve setup wrong. I’ve allowed all WAN traffic to WAN address on ports 80/443.
Unfortunately when doing this I’m still getting a 525 handshake error from cloudflare which I don’t know how to rectify.
Question — What do I do for computers within the LAN that need to go through the proxy to the internal website. I’m able to access the machine within the LAN directly and the ip address: http://10.0.1.158, however for SSL access here is what I’ve tried.
- Created a DNS host override to point my domain name to the 10.0.1.1 (the pfsense/HA proxy address).
- Created a frontend that not only listens on WAN IP Port 80/443, but also LAN IP Port 80/433
- Created frontend acl/condition that if host matches either <domain.com> or www.<domain.com> the connection will be forwarded to the backend.
- Kept the backend the same – forward to 10.0.1.158:80.
I’m assuming this is correct?
In terms of securing the site, mozilla recommends:
global
# intermediate configuration, tweak to your needs
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
ssl-dh-param-file /path/to/dhparam.pem
frontend ft_test
mode http
bind :443 ssl crt /path/to/<cert+privkey+intermediate> alpn h2,http/1.1
bind :80
redirect scheme https code 301 if !{ ssl_fc }
# HSTS (63072000 seconds)
http-response set-header Strict-Transport-Security max-age=63072000
Unfortunately my version of HA proxy does not support ssl-default-bind-ciphersuites or ssl-default-server-ciphersuites so I omitted these.
Here is ha-config:
# Generated on: 2020-01-21 16:47
global
maxconn 1000
stats socket /tmp/haproxy.socket level admin expose-fd listeners
uid 80
gid 80
nbproc 1
nbthread 1
hard-stop-after 15m
chroot /tmp/haproxy_chroot
daemon
tune.ssl.default-dh-param 2048
log-send-hostname domain.com-HA
server-state-file /tmp/haproxy_server_state
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
listen HAProxyLocalStats
bind 127.0.0.1:2200 name localstats
mode http
stats enable
stats admin if TRUE
stats show-legends
stats uri /haproxy/haproxy_stats.php?haproxystats=1
timeout client 5000
timeout connect 5000
timeout server 5000
frontend shared-frontend-WAN-and-LAN-merged
bind 69.xxx.xxx.xxx:443 name 69.xxx.xxx.xxx:443 ssl crt-list /var/etc/haproxy/shared-frontend-WAN-and-LAN.crt_list
bind 10.0.1.1:443 name 10.0.1.1:443 ssl crt-list /var/etc/haproxy/shared-frontend-WAN-and-LAN.crt_list
mode http
log global
option http-keep-alive
option forwardfor
acl https ssl_fc
http-request set-header X-Forwarded-Proto http if !https
http-request set-header X-Forwarded-Proto https if https
timeout client 30000
acl ACL1 var(txn.txnhost) -m str -i domain.com
acl ACL2 var(txn.txnhost) -m str -i www.domain.com
http-request set-var(txn.txnhost) hdr(host)
use_backend domain.com_ipvANY if ACL1
use_backend domain.com_ipvANY if ACL2
frontend http-to-https
bind 69.xxx.xxx.xxx:80 name 69.xxx.xxx.xxx:80
mode http
log global
option http-keep-alive
timeout client 30000
redirect scheme https code 301 if !{ ssl_fc }
backend domain.com_ipvANY
mode http
id 102
log global
option log-health-checks
timeout connect 30000
timeout server 30000
retries 3
option httpchk OPTIONS /
server domain.com 10.0.1.158:80 id 103 check inter 100
With these settings however I can not connect to server either from WAN or LAN:
Here is a wget from LAN side:
--2020-01-21 16:50:47-- https://domain.com/
Resolving gohilton.com (domain.com)... 10.0.1.1
Connecting to gohilton.com (domain.com)|10.0.1.1|:443... connected.
HTTP request sent, awaiting response...
And it sits at this point until a timeout occurs after about 30 seconds or so ( along time) and I finally receive a:
--2020-01-21 16:50:47-- https://domain.com/
Resolving gohilton.com (domain.com)... 10.0.1.1
Connecting to gohilton.com (domain.com)|10.0.1.1|:443... connected.
HTTP request sent, awaiting response... 503 Service Unavailable
2020-01-21 16:52:47 ERROR 503: Service Unavailable.
I’m unclear about cipher settings.
