Tag Info

New answers tagged

2

You should not use redirect for post. If you have to, you should use 307 code for post. A end-user may be prompted about redirection. W3C Specifications - RFC 2616 301 Moved Permanently If the 301 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be ...


1

I've got the same issue recently. Supposed to be is not a packets losing in fact, it have to be invalid packets I guess. One of ClusterIP howtos suggests just to filter them out. iptables -t mangle -I PREROUTING -m state --state INVALID -j DROP


0

If you want people to connect to your server but don't want them to know your IP address then setting up a proxy server somewhere that will forward the traffic to you is the only thing I can think of.


0

Couple of additional thoughts: 1. If you are looking for PCI compliance, you will need to encrypt "data in transit" so you will have to either passthru encrypted traffic to your application, or re-encrypt between the LB and your app server. Decrypting at the LB takes a processing load off your app server and this is a prime reason to terminate SSL at the ...


4

I'm afraid that the answer will be "it depends". I had occasion to dig into it a bit when I was working with internet banking security. This was a couple of years ago, though, so it's entirely possible that someone else will come up with something that I forgot or that's changed during those years. Disadvantages with terminating SSL at the load balancer ...


0

I would say that terminating the SSL traffic at the level of the load balancer or the server depends on if you are okay with unencrypted traffic going between the two or not. In most cases the traffic going from the load balancer to the server(s) is traveling inside a private network where you don't really have to care about eavesdropping and ...


2

You can use a proxy designed for MySQL, such as MySQL Proxy or MaxScale, to not only load balance your read queries, but also to ensure that writes are directed to the master. From the point of view of the clients, there is only one MySQL connection, which is useful for clients which can't make separate connections for reads and writes.


1

Another way, assuming you already have a backend defined for server1 & server2, would be to do the static server selection in the backend, thusly: frontend a-frontend-conf # Declare an ACL using the 'Host' header acl host_domain hdr(host) -i www.domain.com # Use backend 'farm' if acl condition host_domain is fulfilled use_backend farm ...


0

Working solution eventually! Edit /etc/hosts and add: 127.0.0.1 tunnelproxy1 127.0.0.1 tunnelproxy2 127.0.0.1 tunnelproxy3 127.0.0.1 tunnelproxy4 Then go to /etc/squid3/squid.conf and: http_access allow all http_port 3128 cache_peer tunnelproxy1 parent 9001 0 round-robin no-query no-digest cache_peer tunnelproxy2 parent 9002 0 ...


0

Seems like for some reason your regexp doesn't match, thus #sub isn't initialized, and this leads to an error. Try first the non-regexped server_name to see what's wrong.


0

If it is a load-balancer, then yes. If it is a rerouting balancer, then no. You could also set up something that receives the initial request and then redirects the user to a processing server. That's a theoretical answer as I don't know what software you would use, etc. I would like to point out, however, this example: https://stackexchange.com/performace ...


2

You could declare an acl and then do a conditional use_backend statement. Like this: frontend a-frontend-conf # Declare an ACL using path_beg (Path Begins) acl path_images path_beg /images # Use backend server1 if acl condition path_images is fulfilled use_backend server1 if path_images backend server1 [...]


-1

oops i misread the question.... this may be closer to what your looking for? filter on outbound traffic? iptables -P OUTPUT DROP iptables -P INPUT ACCEPT for x in $(cat list.of.allowed.websites.txt); do for i in $(dig $x +short | cut -d\ -f[theip]); do iptables -A OUTPUT -d $i/32 -j ACCEPT; done; done allow all the usual outgoing... ntp, ...


1

I figured out how to fix my issue. Whilst drookie's suggestion to create and ACL for the reverse proxy and apply the tcp_outgoing_address tag to it almost seemed obvious, I had no clue where to begin, let alone how the ACLs are defined / processed. First I had to figure out how the Squid.conf is interpreted (ie. top-to-bottom for first-matched ACLs) and ...


1

Create an ACL for the reverse-proxy traffic and set tcp_outgoing_address <<LAN-IP-HERE>> for it.


0

I've ended up setting the header in the backend server (as @MichaelHampton suggested), so nginx forwards this request to the client. As I am using grails, I've added a filter to add the response header (based on this answer http://stackoverflow.com/questions/6415452/grails-add-header-to-every-response) import javax.servlet.* import ...


1

You will need to mark the connections coming from ether3_3G so that you can then mark the replies to be routed back via ether3_3G. Here's an example configuration (not tested) /ip firewall mangle add action=mark-connection chain=prerouting comment="Mark connection so packets from 3G get returned to 3G properly" disabled=no in-interface=ether3_3G ...


1

You could use MikroTik RouterOS. http://www.mikrotik.com It allows you to setup all 3 internet gateways any way you want and apply any rules you need to load balance the connections. It may have a steep learning curve though depending on your knowledge on networking since you configure everything manually extactly to your needs. There are no wizards. It ...


0

Since June 2014 HAProxy provides native support for SSL, version 1.5.x upwards. There are quite a few options for SSL termination: Stunnel, Stud, Pound, NGINX & HAProxy. (please add comment if there are any other suitable suggestions) While support is available the features available vary greatly. I can neither find feature lists or a comparison ...



Top 50 recent answers are included