-2

I have created 2 instances in Amazon.com with ubuntu and install HAProxy on it. HAProxy in 1st server works.

Haproxy in 2nd server doesn' work since I tried to set up iptables.

I try to execute curl localhost, but it tells me

503 Service Unavailable
No server is available to handle this request

Rebooting of instance didn't help. Help to check it?

Last iptables changes:

iptables -A INPUT -i $WAN -p tcp --dport 80 -j ACCEPT 
iptables -A INPUT -p icmp --dport 80 -j ACCEPT 
iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -s ... -p icmp --icmp-type echo-request -j ACCEPT 
iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

Haproxy config:

    global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        user haproxy
        group haproxy
        daemon

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        contimeout 5000
        clitimeout 50000
        srvtimeout 50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

frontend tutorial_im
        bind *:80
        default_backend tutorial_http
backend tutorial_http
        balance roundrobin
        mode http
        server web1 *.*.*.*:80 check

iptables -L -nv output:

Chain INPUT (policy ACCEPT 2749 packets, 232K bytes)
pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 5704 packets, 675K bytes)
pkts bytes target     prot opt in     out     source               destination
Improve this question
5
  • Can you post your HAProxy configs, output of iptables -L and, most importantly, clarify what you're actually trying to accomplish?
    – GregL
    Sep 9, 2015 at 19:11
  • I have posted. Now i want to knaw where i have nade mistake.
    – mr_blond97
    Sep 9, 2015 at 19:46
  • The logs of haproxy are missing, please show them.
    – neutrinus
    Sep 9, 2015 at 20:21
  • Its strange: # nano /dev/log (Error reading /dev/log: No such device or address) # vim /dev/log ("/dev/log" [Permission Denied])
    – mr_blond97
    Sep 9, 2015 at 20:46
  • /dev/log isn't your log file, but rather the Stalin target that HAProxy sends its logs to. You'll probably want to look somewhere under /var/log for the relevant files. That said, the 503 error code you're getting back makes me think that your backend server isn't UP. Try configuring the stats page and checking it for the servers status
    – GregL
    Sep 9, 2015 at 21:04

2 Answers 2

Reset to default
1

I solved this issue. Amazon EC2 has its own firewall "Security Group", which blocks every connection by default. You need to set up outbound rules. The problem was not in iptables.

Improve this answer
1
  • Thats right... I was wondering why you were using iptables... Mind you it doesn't hurt to have minimal double security.. but can be confusing for others
    – hookenz
    Sep 10, 2015 at 0:49
0

1 ) iptables -A INPUT -p icmp --dport 80 -j ACCEPT

ICMP protocol doesn't have a destination port

2) iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

you accept ESTABLISHED,RELATED connections only for icmp and not for tcp port 80, replace icmp with tcp

Improve this answer
1
  • Why it doesnt work after instance reboot? Check iptables -L -nv output in post please.
    – mr_blond97
    Sep 9, 2015 at 20:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .