Tag Info

New answers tagged

2

After trying to find ways to debug with HAProxy I finally gave in and used tcpdump to debug the network traffic. By importing the TLS key and the PCAP file into my SSL-enabled Wireshark, I found the error very quickly: The Root CA was unknown to HAProxy, so the verify was failing. It turned out, a coworker changed the cert but didn't know this PEM needs ...


0

I ended up using on both nodes : state EQUAL priority 100 The race condition was due to some kind of issue with the security group of the instances. So this is an issue specific to AWS. For an unknown reason, VRRP Unicast works even though not explicitly allowed in the security group. I explicitly opened it (Custom Protocol 112) and it fixed the issue. ...


0

Try adding check-ssl to the server lines to force the health check to run over SSL as well.


0

You need to share your configuration. But the first thing that comes to my mind is that you are probably running without persistent connections (HTTP keep-alive) on a machine where setting up a connection is extremely slow (eg: improperly tuned firewall enabled on the machine). After that it also depends what you call "very slow" of course. Regular ...


0

The maxsock value is the maximum number of sockets that the HAProxy process can create. On most installations I've seen, it's exactly equal to the value for ulimit-n, meaning it's automatically computed. ulimit-n [number] Sets the maximum number of per-process file-descriptors to [number]. By default, it is automatically computed, so it is ...


1

In the situation you describe, you'd still be limited to 1gbps, but it would be spread over your 4 other servers. It might be possible to get more out of it, but we'd need more details about those 5 connections and the underlying infrastructure.


2

If you're not caching or performing content switching (making "routing" decisions based on HTTP URL or headers) why would you need to use something that far up the stack. Just use IPtables to NAT the connections.


1

Well, you don't say what version of HAProxy you're using, but assuming it's 1.5.x, you could use the urlp fetch method something like so: acl IsMale urlp(gender) 0 acl IsFemale urlp(gender) 1 use_backend T1 if IsMale use_backend T2 if IsFemale There's more details on the urlp fetch here.


0

You really need to set up a benchmark that reflects your actual use case. Are you terminating TLS (that's very CPU intensive)? Googling 'haproxy benchmark' and 'pound benchmark' yield lots of results using various methods to simulate clients. Here's an example: http://www.haproxy.org/10g.html - Willy explains their test setup including the software used ...


1

Simply have the FileZilla FTP server announce the correct external ip-address used by HA-proxy, which is something you can configure in Options --> Passive Mode Settings Normally the Linux kernel uses helper modules that scan the clear text FTP command channel for the PASV response to dynamically change that to the correct NAT response and/or to ...


1

Unfortunately, it seems like this is still a work in progress. Have you considered using a separate nginx proxy? So that you forward requests for that backend to an nginx instance, which then does DNS resolution and forwards the request? Not ideak, but may work in a lower traffic environment.


1

Longneck is right, but to fully answer your question: No. HAproxy doesn't support that feature and almost certainly never will.


2

Squid and haproxy are two very different products. Those features make no sense to be a part of haproxy.


0

The way I do this is to use policy based routing with a normal NAT setup on both firewalls. You have two firewalls: fw1 is your normal default route firewall, fw2 is your ssh inbound firewall. The server has two IP addresses assigned to it (on eth0 and eth0:1) the server's default route points at eth0 and goes out fw1, the ip address on eth0:1 is used to ...


2

There is a good SO answer at http://stackoverflow.com/a/26149994/684908 on the subject of performance. The tl;dr is that the NAT (port-forwarding in some cases) introduces some latency. Though, it is likely negligible at smaller scales. I run HAProxy as a container in production with port-forwarding through the Docker NAT bridge. The application and HAProxy ...


3

The chief concern should be that you will have to wait for the container to be updated before getting any security, feature, or bugfix patches. You can't just run yum/apt-get/yast upgrade on the host, you need to either rebuild the container yourself, or wait for someone else to.


0

I think there is a mistake in your backend config. Try instead: frontend https_frontend bind *:443 ssl crt /etc/ssl/certs/ourpublicandprivatecert.pem mode http default_backend web_server backend web_server mode http server s1 10.0.1.4:80 check The changing being the port! And also make sure that your webserver is not redirecting from port 80 to ...


2

I was just trying to do this myself, was having no luck, and decided to resort to my google-fu. The top result for me when looking for multiple levels of rate limiting was this, and I got really excited. Then I saw it had no answers and initially fell into an existential pit of despair. After digging myself out, I kept hacking, and by some stroke of luck, I ...


0

Fleet does not directly interact with load balancers. You could use a "presence" container as described in the example at https://coreos.com/docs/launching-containers/launching/fleet-example-deployment/ to manage an ELB.



Top 50 recent answers are included