83 reputation
27
bio website
location
age
visits member for 3 years, 3 months
seen Mar 19 at 23:53

Apr
20
comment curl can't verify cert using capath, but can with cacert option
Just to clarify, this is a server I (somewhat) control. It is entirely possible that the SSL cert was installed incorrectly. That said, Firefox and Chromium don't show any SSL warnings.
Apr
20
asked curl can't verify cert using capath, but can with cacert option
Apr
13
answered Any conference videos online that you guys can recommend?
Apr
13
awarded  Scholar
Apr
13
accepted OpenSource (Layer 4) Load Balancer that can pass through original client IP?
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
This seems like a very related question: serverfault.com/questions/190570/haproxy-ssl-farm-options
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
The X-Forwarded-For header is very useful. But this doesn't get at the root of the problem. Both the BigIP and TrafficServer have SSL termination at the load balancer level. Based on my current benchmarks, SSL termination is my bottleneck. If I can get an F5 BigIP (and I might be able to), then it may be fast enough. However, that doesn't answer the theoretical problem (which I still think is interesting). My goal is to allow an SSL farm and still have the original client IP passed along to the app servers. This guarantees (theoretically) that SSL will never be the bottleneck.
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
This is looking like the best option. Unfortunately (for me) the more I read about LVS the less it seems I know about networking!
Apr
10
answered Setting nginx as a reverse proxy help
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
I am wondering if HAProxy's "usesrc clientip" option might be the best solution. However, it looks like that depends on TPROXY. I'm running RHEL 5.5, which has kernel 2.6.18. TPROXY isn't included until 2.6.28. I'd rather not have to recompile the kernel, but I guess we'll see.
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
Yes. As I mentioned in the original post, this is exactly how I have STunnel setup. The problem with this approach is that request is being decrypted on the load balancer. That creates a bottleneck because you can't just add more load balancers (while maintaining HA) like you can add more app servers. That is the reason for a load balancer before decrypting SSL.
Apr
10
asked OpenSource (Layer 4) Load Balancer that can pass through original client IP?