2

I have a couple of HA Proxy servers in a master / slave configuration using keepalived.

Initially, the HA Proxy worked by having a default backend of HTTP and HTTPS servers, but over the past year, the use of these have been expanded and that's the bit that's not working.

Initiallly, we used this to direct http and https requests to a bunch of webservers using leastconn and this was fine.

However, we have now started offering some customers some dedicated hosting. We still need their DNS to point to our HA Proxy server so I looked at using ACL within the haproxy cfg to redirect requests based on the domain name that was being requested.

I believed that using the line "acl host_ccp hdr(Host) www.example.com"

with

"use_backend CCP_S if host_ccp"

would then use a backend called CCPS and use the servers contained within.

backend CCP_S
        balance leastconn
        option httpclose
        option forwardfor
        server CCP_Server aaa.bbb.ccc.ddd:80 check weight 1

However, its not working for me.

The HTTPS is very similar.

If I put the server that I want it to go to in the default backend area, it absolutely works (as long as that is the only server in this area) but that would then stop the main servers from working.

The intention is that when someone puts in a specific URL, the haproxy sends it to a specific server if there's a match or sends it to the default set of servers if there isn't.

I'm pretty sure that this can be done but I've started pulling my (very little left) hair out.

Can anyone point me in the right direction please?

Thanks

Stuart

Code Below

global  
#   log /var/lib/haproxy/dev/log local0 debug
#   log /dev/log    local0
#A
log 127.0.0.1 local0
    log /dev/log    local0 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
        stats socket /var/run/haproxy.socket level admin

    # Default SSL material locations

    # Default ciphers to use on SSL-enabled listening sockets.
    # For more information, see ciphers(1SSL). This list is from:
    #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/

defaults
    log global
    mode    http
    option  httplog
    option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http



##-------------------------------------------------------------------
## Enable stats for the whole of haproxy
##-------------------------------------------------------------------

listen haproxystats 
bind    192.168.7.36:8090
        mode    http
        stats   enable                  # Switch stats on
        stats   hide-version            # Don't display haproxy version
        stats   uri /stats     # URL to view stats
        stats   refresh 3s              # Automatically refresh the page for us


frontend Public_ServerFarm 
    bind 192.168.7.61:80
    default_backend  PublicWEB
    log /var/lib/haproxy/dev/log local0 debug

        acl host_ccp hdr(host) -i www.a.com a.com
    acl block_7 src 192.168.7.250 192.168.7.13 192.168.7.18 192.168.7.41
    acl host_garageshoes hdr(host)  -i www.b.co.uk b.co.uk
        acl host_u33c hdr(host) -i c.co.uk c.co.uk

    use_backend block_7_hosts if block_7
    use_backend b if host_b
    use_backend CCP_Scaleway if host_ccp
        use_backend uchristmas if host_u33c

backend garageshoes
        balance leastconn
        option httpclose
        option forwardfor
        server publicwebwoo01 192.168.7.42:80 check weight 1

backend CCP_Scaleway
        balance leastconn
        option httpclose
        option forwardfor
        server CCP_Server 100.101.102.103:80 check weight 1

backend uchristmas
        balance leastconn
        option httpclose
        option forwardfor
        server plat2_woo1 192.168.7.68:80 check weight 1              

backend block_7_hosts
        option          httpchk                 # Do HTTP checks, not just L4
        option forwardfor header X-Client
        option httpclose
        option forwardfor
        balance         leastconn


##############################    LINUX SERVERS   ##############################

      server          PublicWebWoo02 192.168.7.19:80 check weight 1
      server          PublicWebWooAPI01 192.168.7.44:80 check weight 1
      server          PublicWebWooCCP 192.168.7.35:80 check weight 1

##############################################################################



backend PublicWEB
        option          httpchk                 # Do HTTP checks, not just L4
        option forwardfor header X-Client
        option httpclose
        option forwardfor
        balance leastconn
    mode http


##############################    LINUX SERVERS   ##############################

        server          PublicWebWoo06 192.168.7.39:80 check weight 10
        server          PublicWebWoo07 192.168.7.40:80 check weight 10
        server          PublicWebWoo01 192.168.7.42:80 check weight 10
        server          PublicWebWoo03 192.168.7.59:80 check weight 10

##############################################################################



frontend Public_ServerFarmSSL
        bind 192.168.7.61:443
        default_backend  PublicWEBSSL
    option tcplog
    mode tcp
        log /var/lib/haproxy/dev/log local0 debug

        acl host_ccp_SSL hdr(host) -i www.a.com a.com
        acl block_7_SSL src 192.168.7.250 192.168.7.13 192.168.7.18 192.168.7.41
        acl host_b_SSL hdr(host) -i www.b.co.uk b.co.uk
        acl host_u33c_SSL hdr(host) -i www.c.co.uk c.co.uk

        use_backend b_SSL if host_b_SSL
        use_backend block_7_hosts_SSL if block_7_SSL
    use_backend CCP_Scaleway_SSL if host_ccp_SSL    
        use_backend uchristmas_SSL if host_u33c_SSL


backend CCP_Scaleway_SSL
        balance leastconn
        option httpclose
        option forwardfor
        server CCP_Server 100.101.102.103:443 check weight 1

backend uchristmas_SSL
        balance leastconn
        option httpclose
        option forwardfor
        server plat2_woo1 192.168.7.68:443 check weight 1


backend PublicWEBSSL
        balance source
    option ssl-hello-chk
    mode tcp

##############################     LINUX SERVERS SSL  ##############################



        server          PublicWebWoo06 192.168.7.39:443 check weight 10
        server          PublicWebWoo07 192.168.7.40:443 check weight 10
        server          PublicWebWoo01 192.168.7.42:443 check weight 10
        server          PublicWebWoo03 192.168.7.59:443 check weight 10

backend b_SSL
        balance leastconn
        option httpclose
        option forwardfor
        server publicwebwoo01 192.168.7.42:443 check weight 1

backend block_7_hosts_SSL
        balance         leastconn
        option ssl-hello-chk
        mode tcp
#        option          httpchk                 # Do HTTP checks, not just L4
#        option forwardfor header X-Client
        option httpclose
        option forwardfor


##############################    LINUX SERVERS   ##############################

      server          PublicWebWoo02 192.168.7.19:443 check weight 1
      server          PublicWebWooAPI01 192.168.7.44:443 check weight 1
      server          PublicWebWooCCP 192.168.7.35:443 check weight 1

##############################################################################
  • Can you post he full (sanitized) config? – GregL Nov 5 '17 at 1:00
  • Hi Yes - I was out of time but it's below - the only thing I've changed in the file is the external IP (100.101.102.103). The IP 192.168.7.36 in the bind for haproxystats is the local IP of the haproxy box. 192.168.7.61 is the keepalived IP which is why the others are on this bind But, this is it as written. The config file was written before I got here, I added the ACL stuff. but, I'm not a linux guy really -I google a lot, read a lot and then make an attempt. The last thing that happened was a version change on HaProxy broke because of the use_backend - it used to be 2 separate words. – Stuart Hurst Nov 6 '17 at 10:12
  • @GregL - Added it in the original post - thanks :) – Stuart Hurst Nov 6 '17 at 10:21
  • Does it work at all, or just not with HTTPS? – GregL Nov 6 '17 at 20:26
  • I am not sure and the only way to know would be to turn off the main webserver bank (PublicWeb and PublicWebSSL) so that they cannot be accessed, or disable their access within HAProxy - and I can't do this as it will affect a load of websites. – Stuart Hurst Nov 7 '17 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.