I'm trying to do something like this:

  • Clients send HTTP request to HAProxy.
  • HAProxy does the TLS stuff to convert the request into https and forward to a server. HTTP to the client.
  • The server sends https response to HAProxy, then the response is forwarded as HTTP to client.

Currently, I'm not so sure how to achieve that goal with HAProxy. I tried to create a frontend listen on a custom port and then forward to a backend server. This is my HAProxy configuration:

frontend manager_https
    bind *:8443
    mode tcp
    log global
    maxconn 2000
    timeout client 50000
    default_backend     https_be

backend https_be
    timeout connect         5000
    timeout server          50000
    retries                 3
    server                  rtmp-manager check-ssl verify none

Unfortunately, this does not work. When clients send HTTP request, HAProxy also forward the HTTP request to backend server, not HTTPS. How can I change the configuration to make it works as expected?

Another question: Is there any ways to make the offload transparent with client using HAProxy?

I would really appreciate any help!

  • This is apparently not about a forward proxy, but reverse proxy which is normal usage of haproxy. – wurtel Jan 22 '19 at 12:51
  • @wurtel my HAProxy runs on client side. The connection between server and HAProxy is HTTPS, and between client and HAProxy is HTTP. So it should be a forward proxy, right? – Minh Duc Truong Jan 23 '19 at 3:00

Specify the ssl directive in the definition of your backend server, like this:

 server                  rtmp-manager check-ssl ssl verify none

Note that the check-ssl option affects the health checks only, and if ssl is specified, it can be omitted, since health checks are automatically done via SSL.

HAProxy should act as a transparent reverse proxy, so clients should not recognize that the requests are in fact handled by backend servers.

  • That works. About transparency, what I really want is my clients only know about the server. HAProxy acts as MITM. – Minh Duc Truong Jan 23 '19 at 3:00
  • If you mean the backend servers, your clients can't know about them, since the clients typically can't reach the backend servers directly (hence, a reverse proxy). If the clients can reach the servers directly (so you need haproxy for the http->https change only), you can make a fully transparent proxy using iptables and nat/mangle, but you have to set up the proper ipchains rules and routing. Here is a doc about how it can be done, but I think it's overkill in your situation: tldp.org/HOWTO/TransparentProxy-2.html – Lacek Jan 23 '19 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.