1

I've already looked for many posts, but no one solved my problem...

Let me explain the context :

3 containers on a dedicated server :
[10.173.223.10] haproxy
[10.173.223.11] Container_A (contains websites http & https, using hell.com and boom.net subdomains)
[10.173.223.12] Container_B (contain only one https website: secure1.boom.net)
-- I don't use docker, lxd only --

Websites hosting :
All subdomains (mixed hell.com and boom.net) are hosted on Container_A except "secure1.boom.net", hosted on Container_B.

Objectives :
- apache2 servers in containers must receive SSL requests
- apache2 servers in containers must manage redirections in virtualhosts
  (some projects need no-ssl access).

Details about redirections :
Currently, in haproxy config, the "http frontend" use all hostnames (including https website), because i want that the apache2 servers manage the https redirections.

Problem :
- In "Container_B" container: https website (secure1.boom.net) works fine.
  He's alone in this container.
- In "Container_B", the "http-to-https" redirection works fine (managed by apache2).
- All http websites in "Container_A" works fine too.
But:
All other https URL in "Container_A" are failing with 503 error (generated by haproxy).



This is what i found in haproxy.log (503 + SC) :

May  3 09:59:14 haproxy haproxy[5091]: 81.137.48.107:49722 [03/May/2018:09:59:11.303] HTTPS~ CONTAINER_A_SSL/ContA 68/0/-1/-1/3082 503 224 - - SC-- 0/0/0/0/3 0/0 "GET / HTTP/1.1"

I paste here the haproxy config :

# Default SSL material locations
        #ca-base /SHARED/SSL_certs
        #crt-base /SHARED/SSL_certs
        ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
        ssl-default-bind-options no-sslv3
        tune.ssl.default-dh-param 2048
        ssl-server-verify none

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        option  forwardfor
        option  http-server-close
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        ...
        errorfile 504 /etc/haproxy/errors/504.http

#--- FRONTENDS --------------

frontend HTTP
        bind *:80 v4v6
        http-request set-header X-client-IP %[src]
        # CATCH 80 port websites
        acl CASE_A hdr(host) -i site1.hell.com www.site1.hell.com
        acl CASE_B hdr(host) -i site1.boom.net www.site1.boom.net
        acl CASE_C hdr(host) -i site2.boom.net www.site2.boom.net
        # CATCH 443 port website (redirected by apache)
        acl CASE_D hdr(host) -i secure1.hell.com www.secure1.hell.com
        acl CASE_E hdr(host) -i secure2.hell.com www.secure2.hell.com
        acl CASE_F hdr(host) -i secure1.boom.net www.secure1.boom.net
        # PROPERTIES
        reqadd X-Forwarded-Proto:\ http
        # BACKENDS (80 targets)
        use_backend CONTAINER_A if CASE_A
        use_backend CONTAINER_A if CASE_B
        use_backend CONTAINER_A if CASE_C
        # BACKENDS (443 targets)
        use_backend CONTAINER_A if CASE_D
        use_backend CONTAINER_A if CASE_E
        use_backend CONTAINER_B if CASE_F

frontend HTTPS
        bind *:443 v4v6 ssl crt /SHARED/SSL_certs/ no-sslv3
        http-request set-header X-client-IP %[src]
        # CATCH 443 targets
        acl CASE_SSL_D hdr(host) -i secure1.hell.com www.secure1.hell.com
        acl CASE_SSL_E hdr(host) -i secure2.hell.com www.secure2.hell.com
        acl CASE_SSL_F hdr(host) -i secure1.boom.net www.secure1.boom.net
        # SSL PROPERTIES
        reqadd X-Forwarded-Proto:\ https
        acl secure dst_port eq 443
        rsprep ^Set-Cookie:\ (.*) Set-Cookie:\ \1;\ Secure if secure
        rspadd Strict-Transport-Security:\ max-age=31536000 if secure
        # BACKENDS (443 targets)
        use_backend CONTAINER_A_SSL if CASE_SSL_D
        use_backend CONTAINER_A_SSL if CASE_SSL_E
        use_backend CONTAINER_B_SSL if CASE_SSL_F

#--- BACKENDS --------------------

backend CONTAINER_A
        balance uri
        #server ContA ContA.lxd (disabled: resolving dont works since IP are static in container's interface files)
        server ContA 10.173.223.11

backend CONTAINER_A_SSL
        balance uri
        server ContA 10.173.223.11 ssl

backend CONTAINER_B
        balance uri
        server ContB 10.173.223.12

backend CONTAINER_B_SSL
        balance uri
        server ContB 10.173.223.12 ssl

And there is the host iptable rules :

*nat
### WEB
-A PREROUTING -i eth0 -p tcp --dport  80 -j DNAT --to-destination 10.173.223.10:80
-A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.173.223.10:443
### LXD-BRIDGE-AUTO-CONF
-A POSTROUTING -s 10.173.223.0/24 ! -d 10.173.223.0/24 -m comment --comment "managed by lxd-bridge" -j MASQUERADE
COMMIT

*mangle
### LXD-BRIDGE-AUTO-CONF (DHCP:68)
-A POSTROUTING -o lxdbr0 -p udp -m udp --dport 68 -m comment --comment "managed by lxd-bridge" -j CHECKSUM --checksum-fill
COMMIT

*filter
### DEFAULT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
### LOOPBACK
-I INPUT 1 -i lo -j ACCEPT
### ALREADY ACCEPTED CONNECTIONS
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
### LXC: FORWARD
-A FORWARD -o lxdbr0 -m comment --comment "managed by lxd-bridge" -j ACCEPT
-A FORWARD -i lxdbr0 -m comment --comment "managed by lxd-bridge" -j ACCEPT
### LXD: DNS (53) + DHCP (67)
-A INPUT -i lxdbr0 -p tcp -m tcp --dport 53 -m comment --comment "managed by lxd-bridge" -j ACCEPT
-A INPUT -i lxdbr0 -p udp -m udp --dport 53 -m comment --comment "managed by lxd-bridge" -j ACCEPT
-A INPUT -i lxdbr0 -p udp -m udp --dport 67 -m comment --comment "managed by lxd-bridge" -j ACCEPT
### ICMP (ping)
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
### WEB
-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
-A INPUT -p udp -m multiport --dports 80,443 -j ACCEPT
### FINALLY, DROP ALL the fallbacks
-A INPUT -j DROP
COMMIT

Can someone help me ? :/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.