1

I've one routed IP and haproxy is sitting there, haproxy has also lan ip to contact backends. I have few backends - each holding some nginx'es, sometimes few domains services on each one. I've come to moment where i want to narrow down acces to sort of list - my lans + some other ip's. I'm doing ssl termination but this is not important as i know. Essential parts from my config:

frontend https-in
    bind *:443 ssl crt /etc/haproxyssl/domain1.pem crt /etc/haproxyssl/domain2.pem
    reqadd X-Forwarded-Proto:\ https
    acl host_1 hdr(host) -i add.domain1.net
    acl host_1 hdr(host) -i sub.domain1.net
    acl host_2 hdr(host) -i pro.domain2.net
    use_backend worker_1 if host_1
    use_backend worker_2 if host_2
    default_backend worker_2

backend worker_2
    redirect scheme https if !{ ssl_fc }
    balance leastconn
    option forwardfor
    cookie JSESSIONID prefix
    option http-server-close
    acl 2_list src 127.0.0.1 172.18.0.1/24 10.1.2.0/24
    tcp-request content accept if 2_list
    tcp-request content reject
    server dodo 10.1.2.65:80 cookie A check

Of course acl 2_list doesn't work because proxy is in http mode - backend sees haproxy ip, not the client - i'm fine with it - i don't need source ip on backend side. I don't want to make tproxy solutions. HaProxy is v1.5.4 on Gentoo.

Question: Can i have sort of acl list on the frontend for each domain/backend ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.