1

I've one routed IP and haproxy is sitting there, haproxy has also lan ip to contact backends. I have few backends - each holding some nginx'es, sometimes few domains services on each one. I've come to moment where i want to narrow down acces to sort of list - my lans + some other ip's. I'm doing ssl termination but this is not important as i know. Essential parts from my config:

frontend https-in
    bind *:443 ssl crt /etc/haproxyssl/domain1.pem crt /etc/haproxyssl/domain2.pem
    reqadd X-Forwarded-Proto:\ https
    acl host_1 hdr(host) -i add.domain1.net
    acl host_1 hdr(host) -i sub.domain1.net
    acl host_2 hdr(host) -i pro.domain2.net
    use_backend worker_1 if host_1
    use_backend worker_2 if host_2
    default_backend worker_2

backend worker_2
    redirect scheme https if !{ ssl_fc }
    balance leastconn
    option forwardfor
    cookie JSESSIONID prefix
    option http-server-close
    acl 2_list src 127.0.0.1 172.18.0.1/24 10.1.2.0/24
    tcp-request content accept if 2_list
    tcp-request content reject
    server dodo 10.1.2.65:80 cookie A check

Of course acl 2_list doesn't work because proxy is in http mode - backend sees haproxy ip, not the client - i'm fine with it - i don't need source ip on backend side. I don't want to make tproxy solutions. HaProxy is v1.5.4 on Gentoo.

Question: Can i have sort of acl list on the frontend for each domain/backend ?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.