I've been working to implement a load balancer using HAProxy and use the load balancer as a bridge to backend(Terminal Server Windows 2008 R2), so that remote session between client to the load balancer will be secured and clear traffic between the load balancer to the backend without RDP Gateway. Any Idea will be much appreciated. Thanks.

PS : This is a simple configuration for the configuration above

[client(s)] =secure=> [proxy server] =clear=> [pool of windows servers]

log local0
log local1 notice
maxconn 4096
user haproxy
group haproxy
stats socket /tmp/haproxy.sock

log     global
mode tcp
option tcplog
option  dontlognull
maxconn 2000
timeout connect 3h
timeout client 3h
timeout server 3h

frontend secure
bind *:3389 
bind *:443 ssl crt /etc/haproxy/certs/x.pem
mode tcp
default_backend rdp

backend rdp
mode tcp
option tcpka
balance leastconn
tcp-request inspect-delay 5s
tcp-request content accept if RDP_COOKIE
persist rdp-cookie
stick-table type string len 32 size 10k expire 8h
stick on rdp_cookie(mstshash)
option tcp-check
tcp-check connect port 3389 ssl
server ts1 x.x.x.x:3389
  • I'm curious why you're trying to avoid the native Gateway services. – Ryan Bolger Nov 3 '16 at 6:38
  • Due to a few reasons. We are using Autoscaling to scale our terminal server capacity up or down automatically according to conditions and they are all exposed to the public via the HAProxy which does load-balancing, not the RDP gateway. To have the RDP gateway seems to be an extra cost if we can figure out how to implement the SSL connection via the HAProxy. Furthermore, I’m suspicious about how well the RDP gateway can optimize/distribute the traffic as well. – Ryan Park Nov 3 '16 at 21:41
  • This is within the realm of capabilities of HAProxy, assuming RDP doesn't get in your way, and allows SSL offloading to be done for it. Possibly unrelated, but your bind :443 also needs to be configured with ssl and a certificate, if you want HAProxy to speak SSL on port 443. What happens when you test this? What is logged? – Michael - sqlbot Nov 4 '16 at 0:04
  • @Michael-sqlbot I've tested the port no.443 with and without the certificate. without the certificate, I can access to the backend through the proxy server but getting self-signed certificate from the backend. With the certificate, I can't even get into the backend. it seems like the traffic is shuttling (encrypted) bits back and forth between the client and server as GregL mentioned in the comment below – Ryan Park Nov 4 '16 at 1:04
  • You need ssl verify none on the server configuration line if the server is speaking SSL and offering you a cert. – Michael - sqlbot Nov 4 '16 at 1:13

Since you've got your mode set as TCP, you're not actually doing any SSL decryption of the traffic, you're just shuttling (encrypted) bits back and forth between the client and server.

I don't even think you could do what you propose with RDP, since HAProxy only understands HTTP as a layer 7 protocol.

  • That isn't right. bind *:3389 ssl crt ... means HAProxy will insist on negotiating SSL with the client itself, and handling the payload in the clear, internally. If server ... ssl is used on the backend, HAProxy will negotiate a new SSL session with the back-end server and re-encrypt the payload, otherwise it will pass it to the server in the clear. mode tcp directs HAProxy to not try to interpret the connection as HTTP but treat it payload-agnostic, establishing a connection to the server, tying client and server "pipes" together, and forwarding traffic without interpretarion. – Michael - sqlbot Nov 3 '16 at 23:56
  • So are you saying that what OP wants to do is possible then? – GregL Nov 4 '16 at 0:02
  • 1
    Well, it's possible if RDP allows itself to operate behind an SSL offload device, yes. I've transported NFS4 and SMTP (and probably other things) across the Internet wrapped in SSL/TLS using HAProxy with a very similar configuration, the difference being that I had an HAProxy on both ends, to avoid the need for the client system to understand SSL or be reconfigured. If it's TCP and doesn't need any weird stream rewriting (like FTP the PORT command in FTP, yuck) then HAProxy can switch it and handle the SSL. – Michael - sqlbot Nov 4 '16 at 0:11

It is a bit unclear what services you are trying to load balance based on the ports used for the frontend in HAProxy I would say RD Gateways and RD Web Access, but you can never be to sure.

At a first glance I would say that you will need 2 frontend aka VIPs : One listening on 443 to offload ssl connections and another one that will forward unecrypted traffic to the backend i.e.

[client(s)] =secure=> HAProxy VIP 443 =clear=> HAProxy VIP 3389 =clear=> Backends - Pool of windows server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.