Just set up HAProxy for the first time, as a single load balancer balancing 2 servers, each of which run Varnish and Nginx.

Here's the cfg file:


        #uid 99
        #gid 99
        stats socket /var/run/haproxy.stat mode 600 level admin
        maxconn 40000
        ulimit-n 81000
pidfile /var/run/haproxy.pid
        mode    http
        contimeout      4000
        clitimeout      42000
        srvtimeout      43000
        balance roundrobin
listen webfarm
           mode http
           stats enable
           stats auth admin:password
           balance roundrobin
           cookie web insert indirect nocache
           option httpclose
           option forwardfor
           option httpchk HEAD /check.txt HTTP/1.0
           server webA cookie A check
           server webB cookie B check
           option          forwardfor except
           reqadd          X-Forwarded-Proto:\ https
           reqadd          FRONT_END_HTTPS:\ on
listen  stats :7777
        stats enable
        stats uri /
        option httpclose
        stats auth admin:password

Problem is, this only works from localhost. If I do curl from the local machine, the page loads fine. From any other machine, I wait several secons for the page to time out.

There does not appear to be any firewall on any of the servers (yet) and I have tried iptables -F on each machine.

  • Any logs from the load balancer? – Magellan Dec 23 '12 at 19:28
  • I added log local0 notice to global to try and get something out of the logs, but the log file is empty.. – James Dec 23 '12 at 20:22
  • Not related to any answer, but reqadd X-Forwarded-Proto:\ https and reqadd FRONT_END_HTTPS:\ on are wrong as you don't use https. – Dennis Kaarsemaker Dec 24 '12 at 10:08

I got the same problem. My HAProxy was working (confirmed with curl) locally. The command

iptables -P INPUT ACCEPT && iptables -P OUTPUT ACCEPT

fixed my issue!

| improve this answer | |

For the logs, please just use log local0 (without the filtering on notice) and ensure your syslogd is listening to the UDP socket (eg: syslogd -r). Please also add "option httplog" to get a log of the full request.

What you describe makes me think about three possibilities :

  • the connection is blocked somewhere else and does not even reach haproxy
  • the server is not able to respond to a host name other than "localhost" and closes the connection.
  • the server responds with a redirect to a location curl cannot reach (eg: localhost:12345), causing curl to try a few times and fail.

The logs will tell you that. BTW, have you tried with curl -i or telnet to see what is returned by the server ?

Also, when you get this config working, please replace "option httpclose" with "option http-server-close", which will support client-side HTTP keep-alive (I'm assuming you're running 1.4 or 1.5-dev), resulting in better performance and lower latency.

| improve this answer | |

maybe iptables -F is not enough. Try iptables -P INPUT ACCEPT && iptables -P OUTPUT ACCEPT

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.