0

my haproxy configuration is:

# Configuration for 678da17a-5c8f-4d2b-9431-f3019aae9726
global
    daemon
    user nobody
    group haproxy
    log /dev/log local0 debug alert
    log /dev/log local1 notice alert
    maxconn 2000
    stats socket /var/lib/neutron/lbaas/v2/678da17a-5c8f-4d2b-9431-f3019aae9726/haproxy_stats.sock mode 0666 level user

defaults
    log global
    retries 3
    option redispatch
    timeout connect 5000
    timeout client 50000
    timeout server 50000

frontend 8e85521c-f92b-401a-a72f-9f3d9dbd9deb
    option tcplog
    bind 123.44.44.44:5200
    mode tcp
    default_backend 46a948a1-1043-437d-83d0-e25acf0c94fd

backend 46a948a1-1043-437d-83d0-e25acf0c94fd
    mode tcp
    balance roundrobin
    server 9add0118-0255-4ee3-998a-875fb251624b 123.23.23.23:443 weight 1

I want to configure frontend using 5200 port to access backend server 123.23.23.23:443. But when i request https://123.44.44.44:5200, the request change to https://123.44.44.44/index.html. It leads to request failure. Why happens that?

Improve this question
2
  • 1
    Why are you using mode tcp for L7? My first guess is that the backend is rewriting the request to include the default file (index.html) and in the process omitting the port number since 443 is the default for https. First, try changing mode http, and second look at what rewrites are happening on the backend if just a directory is given in the URL. – tater Jul 30 '20 at 14:50
  • using tcp is order to passthrough ssl – PZY Jul 30 '20 at 17:48
0

HAProxy is requesting https://123.44.44.44/ from the backend. That's the root directory and not actually a file, so the backend responds by redirecting the browser to the default (index.html) file, which from the backend's perspective is at https://123.44.44.44/index.html. Confirm this by using developer tools in your browser and you'll likely see the 301 code.

There's (at least) two ways to handle that. First is on the backend web server - the backend knows nothing about port 5200 unless you configure it to. Second is in HAProxy by rewriting the Location: header, e.g.

http-request replace-header Location ^https://123.44.44.44/(.*)$ https://123.44.44.44:5200/\1

If you use the HAProxy approach, note that you would need to do it for IP addresses and domain names separately (if you will be accessing using both and want both to work).

Improve this answer
2
  • Thanks. Why haproxy redirect, port don't change in default. I feel that haproxy design is invalid. – PZY Jul 31 '20 at 3:28
  • Your backend HTTP server is doing the redirect, not HAProxy. – tater Jul 31 '20 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.