I'm in the process of setting up a series of servers as proxies to our application server, primarily to obscure the application server's IP as part of a suite of anti-DDOS measures.

My goal is to have HAProxy accept short-lived HTTP/1.0 connections and forward them to the backend over persistent connections, so as to significantly cut down on the overhead lost to the connection process, slow start, etc.

I have this configuration partly working, but am still seeing a much higher connection rate to the backend than expected - on investigation, it appears that each backend connection is serving between 1 and 5 requests, then being reset by the HAProxy side.

These reset packets always happen after a response is fully received from the server, before any further request is sent, and they happen after a seemingly random delay - sometimes as short as 0.1s, sometimes as long as 20s. Changing HAProxy's timeout settings seems to have no effect.

Does anyone know what would cause HAProxy to exhibit this behaviour, or how I might better go about debugging it?

Edit: Forgot to mention, I was unable to get the backends to generate any meaningful logs, even using tcplog

Configuration (redacted):

    log /dev/log    local0
    log /dev/log    local1 notice
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    maxconn 16384
    chroot /var/lib/haproxy
    user haproxy
    group haproxy

    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  http-keep-alive
    timeout connect         5s
    timeout client          50s
    timeout server          50s
    timeout http-keep-alive 50s
    timeout http-request    30s
    maxconn 4000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http
    # Temporary setting, egress is fragile w/ high rate of connections
    default-server maxconn 200

frontend fe-web
    acl cloudflare src -f /etc/haproxy/cloudflare_ips

    block if !cloudflare

    use_backend be-web

frontend fe-legacy
    option forwardfor header CF-Connecting-IP

    use_backend be-legacy

backend be-web
    server srv-web check
    option httpchk HEAD / HTTP/1.1\r\nHost:\ legacy-domain

backend be-legacy
    server srv-legacy check
    option httpchk HEAD / HTTP/1.1\r\nHost:\ legacy-domain

migrated from superuser.com Jan 29 '15 at 13:19

This question came from our site for computer enthusiasts and power users.

  • Did you ever figure this out? I have the same problem now. – jacobbaer Sep 17 '15 at 18:01
  • I faced a similar issue and this is how I fixed it. – Bandi Kishore Oct 15 '16 at 1:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.