We have used haproxy for 6 years in production load balancing SSL https >> the backends and it works OK. Now however, our Development office wants to use an haproxy setup similar to production to switch between two (2) backend development servers.
Current non-haproxy setup is that the existing dev server handles the SSL and has sub-ports for the individual developers who create / modify code in their own port. EG:
https://cworks.dev.plsxpress.com:/712/url_togoto
https://cworks.dev.plsxpress.com:/333/url_togoto
https://cworks.dev.plsxpress.com:/603/url_togoto
and so on…
So I have setup a standalone server Centos 7 with haproxy haproxy18-1.8.1-5.el7.x86_64
and if I leave out the :ports it cconnects to the backend and logins ok, but only to the default :333 port. Logs show that the :333, :712, or :603 never are seen by the backend.
Once I have this working, I have a second backend that has newer php, apache, etc… that we’ll use and acl rule to direct traffic to the newer environment for testing and subsequent development.
The test original server listens on 10.1.1.10 with all the ports mentioned including
333,712, 603,20333, 20712, 20603
I can telnet to each port from the haproxy server (10.1.1.1) and connect to all ports so it’s not a firewall issue. The logs show that only incoming occurs to backend 10.1.1.10 >> when the address is without the :port#. If I use the :port# I always get https://cworks.dev.plsxpress.com:333/mod.php/login.php
Firefox can’t establish a connection to the server at cworks.dev.plsxpress.com:333.
And nothing shows up in the httpd access_log on the backend.
CONFIGURATION
global
# run background/daemon by default.
daemon
# max number of simultaneous connections. Default 5000
maxconn 5000
# run as user
user haproxy
group haproxy
# where the ssl certs are kept
ca-base /etc/ssl
crt-base /etc/ssl
# enable socket admin
stats socket ipv4@10.1.1.1:9999 level admin
# chroot for maximum protections
chroot /var/lib/haproxy
# log standard clf format.
#log 127.0.0.1:514 local2 info
log 127.0.0.1 local2
#log global
# Allow long URLs
tune.bufsize 65535
# longer for some reason
tune.ssl.default-dh-param 2048
ssl-default-bind-options no-sslv3 no-tls-tickets
defaults
log global
retries 3
timeout connect 5s
timeout client 50s
timeout server 1800s
timeout http-keep-alive 5s
timeout http-request 5s
balance roundrobin
default-server inter 4000 weight 10
########### PORT 333 ###########
frontend SynchFrontProd333
mode tcp
option tcplog
bind 10.1.1.1:33
bind 96.81.169.83:33
default_backend SynchBack333
frontend SisFrontProd333
mode http
option httplog
option dontlognull
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request set-header X-Forwarded-Proto https
bind 96.81.169.83:443 ssl crt star.dev.plsxpress.com.pem no-sslv3
default_backend logic333
acl dev_xr2 hdr(host) -i cworks.dev.plsxpress.com:200-900
use_backend logic333 if { req.hdr(Host),regsub(:[0-9]+$,) -i dev.plsxpress.com }
http-request set-dst-port hdr(x-port)
acl logic712 hdr(host) -i cworks.dev.plsxpress.com:712
use_backend logic712 if logic712
stats uri /haproxy?stats
stats realm StrictlyPrivate
stats auth SPADMIN:nimdaAdmin
errorfile 503 /etc/haproxy/errorfile.http
backend SynchBack333
mode tcp
option tcplog
server server10 10.1.1.10:33333 maxconn 128
server server11 10.1.1.11:33333 maxconn 128
backend logic333
mode http
http-response set-header Strict-Transport-Security max-age=16000000;\ includeSubDomains;
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
option httpchk OPTIONS * HTTP/1.1\r\nHost:\ cworks.dev.plsxpress.com
option log-health-checks
server server10 10.1.1.10:20333,20712 maxconn 256 check agent-check agent-port 9333 agent-inter 4000
server server603 10.1.1.10:20603 maxconn 256 check agent-check agent-port 9333 agent-inter 4000
server server712 10.1.1.10:20712 maxconn 256 check agent-check agent-port 9333 agent-inter 4000
server server11 10.1.1.11:20333 maxconn 256 check agent-check agent-port 9333 agent-inter 4000
backend logic712
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
option httpchk OPTIONS * HTTP/1.1\r\nHost:\ cworks.dev.plsxpress.com
server server712 10.1.1.10:712 maxconn 256 check agent-check agent-port 9333 agent-inter 4000
server server10 10.1.1.10 maxconn 256 check agent-check agent-port 9333 agent-inter 4000
server server11 10.1.1.11 maxconn 256 check agent-check agent-port 9333 agent-inter 4000
Can you help?