1

Just set up HAProxy for the first time, as a single load balancer balancing 2 servers, each of which run Varnish and Nginx.

Here's the cfg file:

global

        #uid 99
        #gid 99
        daemon
        stats socket /var/run/haproxy.stat mode 600 level admin
        maxconn 40000
        ulimit-n 81000
pidfile /var/run/haproxy.pid
        defaults
        mode    http
        contimeout      4000
        clitimeout      42000
        srvtimeout      43000
        balance roundrobin
listen webfarm 91.227.223.61:80
           mode http
           stats enable
           stats auth admin:password
           balance roundrobin
           cookie web insert indirect nocache
           option httpclose
           option forwardfor
           option httpchk HEAD /check.txt HTTP/1.0
           server webA 91.227.223.58:80 cookie A check
           server webB 91.227.221.121:80 cookie B check
           option          forwardfor except 91.227.223.61
           reqadd          X-Forwarded-Proto:\ https
           reqadd          FRONT_END_HTTPS:\ on
listen  stats :7777
        stats enable
        stats uri /
        option httpclose
        stats auth admin:password

Problem is, this only works from localhost. If I do curl 91.227.223.61 from the local machine, the page loads fine. From any other machine, I wait several secons for the page to time out.

There does not appear to be any firewall on any of the servers (yet) and I have tried iptables -F on each machine.

3
  • Any logs from the load balancer?
    – Magellan
    Dec 23, 2012 at 19:28
  • I added log 127.0.0.1 local0 notice to global to try and get something out of the logs, but the log file is empty..
    – James
    Dec 23, 2012 at 20:22
  • Not related to any answer, but reqadd X-Forwarded-Proto:\ https and reqadd FRONT_END_HTTPS:\ on are wrong as you don't use https. Dec 24, 2012 at 10:08

3 Answers 3

1

I got the same problem. My HAProxy was working (confirmed with curl) locally. The command

iptables -P INPUT ACCEPT && iptables -P OUTPUT ACCEPT

fixed my issue!

0

For the logs, please just use log 127.0.0.1 local0 (without the filtering on notice) and ensure your syslogd is listening to the UDP socket (eg: syslogd -r). Please also add "option httplog" to get a log of the full request.

What you describe makes me think about three possibilities :

  • the connection is blocked somewhere else and does not even reach haproxy
  • the server is not able to respond to a host name other than "localhost" and closes the connection.
  • the server responds with a redirect to a location curl cannot reach (eg: localhost:12345), causing curl to try a few times and fail.

The logs will tell you that. BTW, have you tried with curl -i or telnet to see what is returned by the server ?

Also, when you get this config working, please replace "option httpclose" with "option http-server-close", which will support client-side HTTP keep-alive (I'm assuming you're running 1.4 or 1.5-dev), resulting in better performance and lower latency.

0

maybe iptables -F is not enough. Try iptables -P INPUT ACCEPT && iptables -P OUTPUT ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .