My first haprox setup is wrong

Help!
1

I have a vm with pihole running well. pihole is at 192.168.1.228. it has a working webmin running on lighttpd on port 80. from my pc I can access it at http://192.168.1.228/admin

it works

I tried to expose it using nat port forwarding on my router. ( port tcp 80 forwarded to port 80 at 192.168.1.228)

it works.

then i created a new vm with haproxy at 192.168.1.223. i removed previous forward rule and setup forwarding of port 80 tcp to .223

this is my config

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # Default ciphers to use on SSL-enabled listening sockets.
        # For more information, see ciphers(1SSL). This list is from:
        #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
        # An alternative list with additional directives can be obtained from
        #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
        ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
        ssl-default-bind-options no-sslv3

listen  stats   
        bind            192.168.1.223:1936
        mode            tcp
        log             global

        maxconn 10

        clitimeout      100s
        srvtimeout      100s
        contimeout      100s
        timeout queue   100s

        stats enable
        stats hide-version
        stats refresh 30s
        stats show-node
        stats auth notadmin:notistherealpassword
        stats uri  /haproxy?stats

defaults
        log     global
        mode    tcp
        option  tcplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

frontend http
        bind *:80
        acl acl_pihole2 hdr(host) -i pihole2.ismyservice.space
        use_backend pihole2_web if acl_pihole2

backend pihole2_web

        server web 192.168.1.228:80 check

service log

eealtebo@192.168.1.223:~$ tail /var/log/haproxy.log
Aug 21 20:46:49 haproxy1 haproxy[25006]: [WARNING] 232/204649 (25006) : parsing [/etc/haproxy/haproxy.cfg:30] : the 'clitimeout' directive is now deprecated in favor of 'timeout client', and will not be supported in future versions.
Aug 21 20:46:49 haproxy1 haproxy[25006]: [WARNING] 232/204649 (25006) : parsing [/etc/haproxy/haproxy.cfg:31] : the 'srvtimeout' directive is now deprecated in favor of 'timeout server', and will not be supported in future versions.
Aug 21 20:46:49 haproxy1 haproxy[25006]: [WARNING] 232/204649 (25006) : parsing [/etc/haproxy/haproxy.cfg:32] : the 'contimeout' directive is now deprecated in favor of 'timeout connect', and will not be supported in future versions.
Aug 21 20:46:49 haproxy1 haproxy[25006]: [WARNING] 232/204649 (25006) : config : 'stats' statement ignored for proxy 'stats' as it requires HTTP mode.
Aug 21 20:46:49 haproxy1 haproxy[25006]: Proxy stats started.
Aug 21 20:46:49 haproxy1 haproxy[25006]: Proxy stats started.
Aug 21 20:46:49 haproxy1 haproxy[25006]: Proxy http started.
Aug 21 20:46:49 haproxy1 haproxy[25006]: Proxy http started.
Aug 21 20:46:49 haproxy1 haproxy[25006]: Proxy pihole2_web started.
Aug 21 20:46:49 haproxy1 haproxy[25006]: Proxy pihole2_web started.

If I try to access the service from outside the lan, i see in chrome that service not responds.
not a 404
i got ERR_CONNECTION_CLOSED
i tried using http://mypublicip:80/admin

I logged into the haproxy using ssh, and verified that pihole2 (228) is pingable and using curl I verified that wenserver replies well.

also, i tried from haproxy1 to run

realtebo@haproxy1:~$ curl http://pihole2.ismyservice.space:80/admin -sSL -vv

amd i see pihole2 admin webpage.

what am I doing wrong? why from outside i cannot see the web page?

2

I solved changing from tcpmode to http mode.

Why can’t this work with tcpmode?

3

Because you are accessing a HTTP variable: a http header. Can’t do that in tcp mode.

Use the default_backend directive in case you just want everything to go to a backend.

1 Like