Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my question is about proposed implementation of high available and secure FrontEnd to WebApps behind a firewall. The components of the network and their relationships are as follows:

1) 2 WebApps servers behind a firewall (BackEnd), denoted by GUI1 and GUI2, running Web Applications

2) 2 machines LB1 and LB2 located in DMZ configured with floating IP in active/standby mode for redundancy. Their task is

  • to give an additional layer of security serving as a proxy (they are performing NAT on packets coming from GUI)
  • to handle the traffic basing on inspection of cookies (in fact the only requirement is to achieve cookie-based session persistence, not sophisticated LB techniques)

Security requirments:

  • The only acceptable communication method with GUI that is allowed (clearly through the FireWall) is via reverse SSH tunnel.
  • The traffic incoming to FrontEnd is most often https (and some http)

The question is: what kind of software (open source) is the best option to be implemented on frontend machines LB1 and LB2, to realize these goals? Recall, in short:

  • SSL termination (as necessary for inspecting cookie)
  • Cookie Based LB
  • active/standby mode

I have no practical experience in this field, however it seems that NginX on LB1 and LB2 (to solve SSL and cookies issue) together with HearBeat (to achieve the desired redundancy property) should work.

I am aware that the proposed architecture is somehow similar to HAproxy or LVS (configured as two redundant instances), however I need a solution that guarantees dealing with all described tasks simultaneously (for instance, HAproxy does not support SSL termination).

Any comments and suggestions are welcomed. Thanks!

share|improve this question

closed as not constructive by Tom O'Connor, Skyhawk, HopelessN00b, Scott Pack, John Gardeniers Nov 12 '12 at 6:07

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Looks like a shopping question, but have a look at (if you cant afford f5-bigip). – user130370 Aug 17 '12 at 23:12
up vote 1 down vote accepted

how about nginx behind haproxy?

share|improve this answer
I am not sure if I have understood correctly. Did you mean setting an nginx server in front of haproxy in such a way that the request from the webbrowser is send through the nginx server first where SSL is terminated if necessary and next to haproxt server which performs load balancing to the suitable backend server? In this way nginx would be used as SSL terminator only and in fact both servers could be running on the same machine (nginx is listening on http and https port and forwarding packages on another port where haproxy is configured to listen). Does it make sense? – MaciejS Aug 18 '12 at 17:25
@MaciejS - i was rather thinking about having HAProxy as internet facing server [if you have so much load] to do load balancing between nginxes. and nginxes as ssl terminators / cookie-based load balancers between your backends. although probably just nginx might be enough. – pQd Aug 18 '12 at 19:17

With native SSL support coming in haproxy in a few days/weeks, maybe you'll want to be a happy beta tester ? :-)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.