Hey, I'm pretty new to HAProxy. I have HAProxy for OPNSense installed. I need to route the websites like this:
aaa.website.com → 10.0.0.20:3000
bbb.website.com → 10.0.0.20:9001
I've followed through a tutorial that uses HAProxy's GUI, but it doesn't work like it should've. When I go to either URL, it always redirects to 10.0.0.20:9001. It feels like the Conditions isn't working.
Here's what I find so far.
When I disable the bbb.website.com routing, it goes to 10.0.0.20:3000 insteal.
Nothing changes when I change the conditions between "Host matches", "Host starts with", and "Path starts with"
Here's the config file it generates. Hope you guys can help me figure this out. Where do I do wrong? Thank you.
#
# Automatically generated configuration.
# Do not edit this file manually.
#
global
uid 80
gid 80
chroot /var/haproxy
daemon
stats socket /var/run/haproxy.socket group proxy mode 775 level admin
nbproc 1
nbthread 1
hard-stop-after 60s
no strict-limits
tune.ssl.default-dh-param 2048
spread-checks 2
tune.bufsize 16384
tune.lua.maxmem 0
log /var/run/log local0 info
lua-prepend-path /tmp/haproxy/lua/?.lua
defaults
log global
option redispatch -1
timeout client 30s
timeout connect 30s
timeout server 30s
retries 3
default-server init-addr last,libc
# autogenerated entries for ACLs
# autogenerated entries for config in backends/frontends
# autogenerated entries for stats
# Frontend: aaa.website-frontend ()
frontend aaa.website-frontend
bind <public ip>:443 name <public ip>:443 ssl crt-list /tmp/haproxy/ssl/62860e9ae771b1.85868225.certlist
mode http
option http-keep-alive
default_backend aaa.website-pool
# remove quotes from persistence cookie
http-request replace-header Cookie '^(.*?; )?(SRVCOOKIE=)"([^;"]*)"(;.*)?$' \1\2\3\4
option forwardfor
# tuning options
timeout client 30s
# logging options
# ACL: aaa.website-condition
acl acl_6285f09d52c084.11538800 hdr(host) -i aaa.website.com
# ACTION: aaa.website-rule
use_backend minio-pool if acl_6285f09d52c084.11538800
# Frontend: bbb.website-frontend ()
frontend bbb.website-frontend
bind <PUBLIC IP>:443 name <PUBLIC IP>:443 ssl crt-list /tmp/haproxy/ssl/628b4dc076fb31.08116587.certlist
mode http
option http-keep-alive
default_backend bbb.website-pool
# remove quotes from persistence cookie
http-request replace-header Cookie '^(.*?; )?(SRVCOOKIE=)"([^;"]*)"(;.*)?$' \1\2\3\4
option forwardfor
# tuning options
timeout client 30s
# logging options
# ACL: bbb.website-condition
acl acl_628b4d6be9ca63.54049274 hdr(host) -i bbb.website.com
# ACTION: bbb.website-rule
use_backend bbb.website-pool if acl_628b4d6be9ca63.54049274
# Backend: aaa.website-pool ()
backend aaa.website-pool
# health checking is DISABLED
mode http
balance source
# stickiness
stick-table type ip size 50k expire 30m
cookie SRVCOOKIE prefix
# tuning options
timeout connect 30s
timeout server 30s
http-reuse safe
server AAAWebsite 10.0.0.20:9001 cookie 6285ea40a5676578102176
# Backend: bbb.website-pool ()
backend bbb.website-pool
# health checking is DISABLED
mode http
balance source
# stickiness
stick-table type ip size 50k expire 30m
cookie SRVCOOKIE prefix
# tuning options
timeout connect 30s
timeout server 30s
http-reuse safe
server BBBWebsite 10.0.0.20:3000 cookie 628b4c8a370ce282698357
A frontend is a listener, listening a specific post of a specific IP.
However, one port of a IP can bind with one frontend at a time.
When you have 2 frontend listening to the the same port of same IP, only one of them will work.
That's why you find only one of them work.
The process to make a simple HAProxy work:
(Assume all real server are http services, and you don't need to redirect port 80 to 443)
I won't write too detail, you may need to fill in other stuffs like cert etc.
1. Create real servers
2. Create backends, each real server should have at least one backend
3. Create conditions to check sni (example: SNI TLS extension matches (TCP request...), aaa.website.com), until you make all condition
4. Create rules to redirect to a backend if specific condition is true, one rule for each condition
Example:
Name=aaa_ru, if, aaa_cond, use specific backend, aaa_back
5. Create 1 frontend listening to "WAN IP"*#:443, put all rules you created in 4 to rules part.
#If you have dynamic IP, you might need to create a Loopback VIP, frontend bind to that VIP, firewall port forward set to that VIP.
If you need more advanced setting, you may check
https://forum.opnsense.org/index.php?topic=23339.0 (https://forum.opnsense.org/index.php?topic=23339.0)
Ah, that's it. Just need to include two conditions into one front end.
Thanks for pointing that out.