Tag Info

Hot answers tagged

6

Using round robin DNS is not that great for high availability - if one server goes offline, clients will still try to connect to it and wait for a timeout. There are other ways to achieve this. 1) Active/Passive load balancers Basically one load balancer handles all traffic for one IP address. If that balancer goes down, the passive node jumps in and ...


5

High Availability with load balancers is commonly implemented using a virtual ip address (VIP) protocol which allows several hosts (i.e. load balancers) to answer to one common ip address in one of several possible ways (variations on active/passive, active/active). There are a good number of these protocols, the ones I have seen most with regular load ...


3

Yes, there's a standard: Don't use X-Forwarded-For at all. RFC 7239 defines the Forwarded header, which has rather different semantics from X-Forwarded-For, and new implementations ought to be using it. Unfortunately it suffers from the same problem you have identified with X-Forwarded-For here: it may be defined twice in a request or contain a comma ...


2

If you want to use rate-limit sessions, is the following feasible for you? frontend http_in bind 0.0.0.0:80 acl is_path url_beg /path/example/ use_backend forwarder if is_path backend forwarder server localhost 127.0.0.1:4444 send-proxy frontend limit_path_backend bind 127.0.0.1:4444 accept-proxy rate-limit sessions 10 default_backend ...


2

I feel that hdr_sub is better for your needs. I was using hdr_end for a while but it runs into the following problem: requests with port 80 usually get the port stripped so the host header looks like "example.com", but if you were requesting on a port explicitly, like example.com:8080, the header will have the port, and hdr_end will fail the check for ...


2

Stick tables do in fact have an expiry, but it's counted/calculated per entry, not per table. Per the docs: expire Defines the maximum duration of an entry in the table since it was last created, refreshed or matched. The expiration delay is defined using the standard time format, similarly as the various timeouts. The maximum duration is slightly ...


1

Okay, found the answer! First: everything is working fine with path_end and SSL-Termination. But, if I'm using the option 'http-tunnel', than there is only the first request processed. All subsequent requests are just forwarded.


1

In IIS 10 you can have: Name Bindings ---- -------- Default Web Site https *:443:*.bar.com sslFlags=3 https *:443:*.bar.net sslFlags=3 https *:443:*.foo.edu sslFlags=3 and use the CCS for all bindings, but you can't do: https *:443:*.*.com sslFlags=3 or https *:443:*.com ...


1

Put the server in drain mode using the web management interface. That provides the exact functionality you're looking for.


1

Other ways synchronize session files between servers (needs a way to synchronize files between several servers, or a common single mountpoint) If your backend servers use PHP for the application(s) you can use Memcache to sync the sessions between them. Also Couchbase-Server can do memcache replication out of the box. Of course it's kind of ...


1

Explicitly set bind-address=0.0.0.0 in my.cnf. Additionally (you've probably already done this if you are this far): ensure each host has the ip address 10.1.1.113 (if using keepalived, then via a dummy interface as /32). set net.ipv4.conf.default.rp_filter = 2 in /etc/sysctl.conf set net.ipv4.conf.default.accept_source_route = 0 in /etc/sysctl.conf ...


1

What you're looking for is called 'Direct Server Return', or DSR for short. You can't do DSR with HAProxy, but LVS or other layer 4 load-balancers can do it. If you've just doing layer 4, then HAPproxy might be a little overkill anyway.


1

Maybe there is some misconfiguration on selinux(if you are using a redhat based distribution) or on apparmor(if you are using ubuntu). Try to stop them in order to verify if this is the problem. You can also try to read the configuration file using the user running the haproxy daemon using the command sudo -u cat /etc/haproxy/haproxy.cfg


1

Please run HAProxy in debug mode ('debug' statement in global section or '-d' when running haproxy deamon) and report here output of stdout and stderr. In the mean time, please take a tcpdump of the DNS traffic of the box and send it to the dev who did the DNS work in HAProxy: bedis9@gmail.com. Baptiste


1

The easy way is: 1 - Configure your web server to return 503 code if a file named maintenance.html (for example) exists. With apache you can do it as follows: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{ENV:REDIRECT_STATUS} !=503 RewriteCond "/var/www/maintenance.html" -f RewriteRule ^(.*)$ /$1 [R=503,L] </IfModule> 2 - ...



Only top voted, non community-wiki answers of a minimum length are eligible