4
votes
How to support TLS 1 and TLS 1.1 with haproxy 2.4 and OpenSSL 3?
With OpenSSL 3.0.1 they (rightfully) moved TLS 1.0 and 1.1 to security level 0, because they're utterly useless and insecure. It's a horrible idea to support these protocols, it's actually worse than ...
- 880
3
votes
Accepted
Why is "tcp-request content accept" frontend instruction is required for proper HAProxy SNI-based routing?
I will try to answer my own question after giving it some thought.
So, HAProxy docs also have the following mention:
http://cbonte.github.io/haproxy-dconv/2.0/configuration.html
If content switching ...
- 41
2
votes
Haproxy log format to mimic Common log format
I found that haproxy supports this with the clf option
defaults
mode http
option httplog clf
equivalent to:
log-format "%{+Q}o %{-Q}ci - - [%trg] %r %ST %B \"\" \"\" %...
- 175
2
votes
Kill tcp connections to all backends when any of the haproxy backend gets healthy
This might help https://www.haproxy.com/blog/introduction-to-haproxy-stick-tables/#making-decisions-based-on-stick-tables
Actually they are using sticky table and only single entry will be stored. ...
- 2,601
2
votes
HAProxy: Defer TCP connection to backend only after first data arrives
Was looking for this myself, found the answer in the the examples of the config reference: https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#4-tcp-request%20content
in the frontend:
tcp-...
1
vote
Accepted
cURL to OWA not working from newly-installed RHEL server but working from Ubuntu server
keep in mind that RHEL does not use the last versions on many of its packages. But it comes with other advantages...
For example, HAProxy version:
Ubuntu 22.x → HAProxy 2.4.x
RHEL 8.7 → HAProxy 1.8.x
1
vote
Accepted
HaProxy - Does prefer-client-ciphers mean the client can choose a cipher not supported by a server?
This answer is not based on Haproxy specifically but general TLS behavior:
The TLS client and the TLS server each has a list of ciphers that it can support/accept, these lists are ordered by their ...
- 34.4k
1
vote
Accepted
Check response of one backend before proxying to another
Not a complete answer, but slightly too long for comment:
The set-up you describe is in concept similar to a fairly common strategy :
offload the authentication to one system
use your reverse proxy ...
- 1,713
1
vote
Accepted
How to configure HAProxy to ignore client header `Pragma: no-cache`?
Web browsers send Cache-Control and Pragma headers that mess with HAProxy and make the caching virtually unusable due to its inability to cache if cache-control or pragma headers are "no-cache&...
- 26
1
vote
Adding subdomains in haproxy for CORS
That response would answer to ANY domain with correct CORS, so you potentially allow MITM. You take whatever request had, and say in CORS that is allowed, its equivalent to *.
if you want that to be ...
- 11
1
vote
HAProxy Does Not Recover After Failed Check
I had the same issue and my services are hosted in kubernetes. It turns out it's a k8s dns issue. I fixed it by adding
resolvers mydns
parse-resolv-conf
hold valid 10s
backend your_backend
...
...
- 111
1
vote
Accepted
How to forward traffic from HaProxy to an IIS FTP server?
FTP is a crappy protocol that requires two connections:
For passive FTP that is initially one connection, the control connection. That connection is made by the client, typically to the default port, ...
- 1,177
1
vote
Basic auth and data from curl to HAProxy backend not working on TLS Termination - but works on TLS passthrough
I am not able to understand fully on your HAProxy confiugration but it looks like you are hardcoding headers for your backend. Instead I would add the HTTP headers from curl. Don't forget content-type,...
- 229
1
vote
Accepted
How to persist configuration changes made to HAProxy via its API?
You’ll want to look at the HAProxy Dataplane API. It’s a separate method, but persists changes.
- 4,991
1
vote
Unable to access web service with floating IP address assigned to my machine
I don't think you can, most people just bind to one IP address or ALL of them.
You would have to use a separate front end for each one using the same backend. But everyone just uses the * which works ...
- 777
1
vote
In Using pfSense HAProxy - to check the url if it has a sub domain name
I would look at the default_backend operator. Basically send anything that doesn't hit another ACL to a specific backend.
- 4,991
1
vote
Accepted
Freeipa web interface behind HAProxy
FreeIPA does not support running behind HA proxy, whatever product you'd use for that. I'd suggest you to read https://ssimo.org/blog/id_019.html for basic technical details to understand why is it ...
- 1,075
1
vote
haproxy SSL/TLS Passthrough Proxy not working?
Since you pass the connection through to Gmail, the client also gets the Gmail certificate, which obviously is only valid for the Gmail host.
The certificate must contain the hostname you are ...
- 21.7k
1
vote
Accepted
HAProxy path_beg error - 503 service unavailable
im guessing you are going to http://172.18.1.125:8888/api/authorization/oauth/sign-key instead of 172.18.1.125:8888/oauth/sign-key like you expect cause you are doing nothing to strip out 'api/...
- 146
Only top scored, non community-wiki answers of a minimum length are eligible