Hot answers tagged

3

Varnish does not support SSL Running a site/service on SSL is a necessity for anything half serious, so thats one reason to use haproxy which will do SSL termination for you.


2

defaults log global retries 2 timeout connect 3000 timeout server 5000 timeout client 5000 listen any-name-1 bind IP-Address:port mode tcp or http option user-check user haproxy_check balance roundrobin server hostname IpAddress:port check server hostname IpAddress:port check listen any-name-2 bind IP-Address:port mode tcp or http option user-check user ...


2

You could try out the following, either in your frontend or backend section(s): acl set_cookie_len res.hdr(Set-Cookie) -m len 0 rspidel Set-Cookie if set_cookie_len What this does: Checks the length of the Set-Cookie header against 0; evaluates to TRUE or FALSE. Removes the response header if set_cookie_len is TRUE. Some notes: I couldn't test this ...


2

Haproxy requests a valid return from the IIS server (http 200/300), in your case I am guessing it returns a 404 since a default index page does not exist. You may also want to add the url you wish to check (/test.html) to the httpchk config line.


1

You might try using the following for the backend SFTP servers: listen frontend_ssh 1.1.1.1:22 mode tcp option tcplog balance roundrobin server server1 2.2.2.2:22 server server2 3.3.3.3:22 I based the above on this post: http://jpmorris-iso.blogspot.com/2013/01/load-balancing-openssh-sftp-with-haproxy.html Hope ...


1

You're config is setup to use mode tcp for the frontend https block. Change it to mode http and you should be fine. The reason is that HAProxy isn't decoding your HTTP requests, but rather just looking at layer 4 information (source & destination IP and ports).


1

well if you have list of all valid urls as you said create an acl for valid urls like acl valid_path path_beg -i /path1 path_beg -i /path2 path_beg -i /path3 path_beg -i /path4 http-request redirect location http://submdomain.host.com/support if !valid_path


1

As it happens, HAProxy has a converter to decode the field, making sure that your ACL will always match a given string. url_dec Takes an url-encoded string provided as input and returns the decoded version as output. The input and the output are of type string. You'd use it like this. frontend example acl restricted_page path_beg,url_dec -i ...


1

The bind and listen are not the same things nor things that can be done independently. They are consequent stages on the same port number. It is well described in this diagram from Wikipedia:


1

You can expose SSH on any port you desire. The clients must be aware of that, however. listen ssh-balanced bind <public-ip>:5022 mode tcp server term01 <internal-ip1>:22 check server term02 <internal-ip2>:22 check You need to use ssh -p5022 to connect, and scp -P5022 etc.


1

One thing to consider is that many HTTP clients (including browsers) try to amortize the cost of the SSL handshake out over several HTTP requests. That is, they make one TCP connection to the server, perform the SSL handshake, and then reuse that TCP connection (with its SSL session) for multiple requests/responses, rather than performing an SSL handshake ...


1

While both HAProxy and Varnish can load-balance, only one of them is built for it. You could just use Apache for your purposes as well since it can proxy and cache as well, but it's hardly an optimal solution. In my opinion, you're best to use each product for what it's best at. What I do is install both on the same box and configure Varnish to use ...



Only top voted, non community-wiki answers of a minimum length are eligible