Messages

16

21.7 Legacy Series / Still seeing issues with HAProxy config changes

« on: November 25, 2021, 11:36:09 am »

I thought HAProxy config issues were fixed in 21.7.5?

I just cloned a different real server, change its port.
Created all the backend pools and stuff for it, but its still using the port from the copied setup.

I know there were issues in 21.7.4 and there was a patch for it, so I thought in .5 it was resolved?
Do I have to re-apply that same patch?

EDIT I was being dumb, I forgot to change the Server on the backend

17

21.7 Legacy Series / DNS over TLS not working?!

« on: November 24, 2021, 09:41:56 am »

So I am trying to get DNS over TLS to work, and I must be going wrong somewhere and seeking a bit of guidance.
I really wish there was a proper guide somewhere but there are so many little ways to do things.
Bit of background I run Dual WAN so I have setup the rule for DNS as per the guide for that.

Ok first: SYSTEM: SETTINGS: GENERAL
I left DNS servers blank
Unticked Allow DNS server list to be overridden by DHCP/PPP on WAN
Unticked Do not use the local DNS service as a nameserver for this system
And I did tick Allow default gateway switching (due to dual wan)

Next DNS:
SERVICES: UNBOUND DNS: GENERAL


SERVICES: UNBOUND DNS: DNS OVER TLS
I used 9.9.9.9 for IP
853 for Port
dns.quad9.net for CN Hostname

FIREWALL: RULES: LAN
IPv4 TCP/UDP   *   *   10.0.0.1   53 (DNS)   *   *   Local Route DNS   
As per the Dual WAN guidance.
I did try to clone this rule and use port 853 but to no avail.

If I use https://tenta.com/test/ or https://1.1.1.1/help
Both say DNS over TLS NO

So I'm wondering where in my setup is it incorrect that DNS over TLS doesnt engage?

18

21.7 Legacy Series / Re: HAProxy change Real Server IP not taking effect

« on: November 08, 2021, 04:29:04 pm »

no, nothing else is required. changes are included in the next release afaik

Thanks buddy, appreciate it and the fast fix.

19

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: November 08, 2021, 10:13:16 am »

FYI I got it working the Basic Auth.

So 21.7.4 has an issue with HAProxy where changes to config are not being saved: https://forum.opnsense.org/index.php?topic=25480.0
After I applied the patch it is working.

For Basic Auth all I did was create a user under User Management
(There does seem to be some restrictions around password length or complexity, I didnt spend a load of time testing)
My 20+ Char passwords would not work until I dumbed it down a bit.

So once you have a user go to your Backend Pools, choose your desired service, scroll down to Basic Authentication -> tick the box and add the username you just created.

Boom it works.

20

21.7 Legacy Series / Re: HAProxy change Real Server IP not taking effect

« on: November 08, 2021, 09:51:40 am »

https://forum.opnsense.org/index.php?topic=25337.0 ?

If I apply this patch, and then 21.7.5 comes out, will it overwrite the patch?
Basically I want to keep my FW as close to standard as possible.

Or once its fixed in mainstream do i need to remove patch or anything?

21

21.7 Legacy Series / Re: HAProxy change Real Server IP not taking effect

« on: November 08, 2021, 08:49:48 am »

Cheers mate, didnt see that

22

21.7 Legacy Series / HAProxy change Real Server IP not taking effect

« on: November 07, 2021, 10:58:25 pm »

So I have HA running on 10.0.0.9:8123.
I spun up a new VM and change the IP address of the Real Server from 10.0.0.9 to 10.0.0.12.
All good shows correct IP in Real Servers tab.

BUT its still using the old IP.

I look in maintenance tab and it still shows 10.0.0.9...
I have restarted OPNsense, I've disabled HAProxy and re-enabled.
I've tried disabling the service, changing IP address to something random and back to 10.0.0.12, but ye its still linking to the .9 IP.

HOW can I get the change to take effect?

23

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: November 06, 2021, 11:29:59 am »

AMAZING! Thank you so much

24

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: November 05, 2021, 09:29:43 pm »

Hey @TheHellSite, Do you know a way I can add Basic Auth to one of the sub domains?

I have a dashboard which just runs without login and I would really like it secured behind just basic auth if possible.
I tried creating a condition and a rule and applying it to the sub domain but it doesnt seem to work.

I also saw on the backend there is an option on the domain for basic auth checkbox, so I tried that but no dice either.

Any chance you can add a section to the guide about securing singular domains with basic auth?

25

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: October 09, 2021, 05:58:49 pm »

The error is not related to your dual WAN setup. 
I misread something in your HAProxy config...

Code: [Select]

server jellyfin 10.0.0.10:8090 check inter 2s port 8090  ssl verify noneYou see that "ssl" word in your server config?
SSL and HTTP don't like each other! 

Since your services are NOT using HTTPS but only HTTP locally... you need to UNCHECK the SSL checkbox in the HAProxy real server config for both of your servers.

Oh my days!!!
That worked! I spent all night trying to figure it out.

Thank you so very much!

26

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: October 09, 2021, 04:07:09 pm »

Yes OPNsense is my only router/firewall.

I have dual WAN created a gateway group to double internet speed.
I created the rule on only 1 WAN gateway tho, and my a records point to the same IP.

I have 3 LANs (not VLANS) 10.0.0.1 (Main LAN) - 192.168.107.1 (IoT) - 192.168.200.1 (Guest)
My NAS Server (10.0.0.10) and OPNsense (10.0.0.1) are on 10.0.0.1/24 LAN, so no going through anything different there.

I wonder if with the dual WAN it needs a specific rule?
As with dual WAN I have to change the default gateway on the Allow LAN to any rule to the specific Multi_Gateway...
Like my LAN can no longer talk to my IOT Lan without having a specific rule to say allow...

I've just added the LAN Net to Loopback but still no dice

27

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: October 09, 2021, 03:17:58 pm »

Please confirm you are accessing your servers internally using:

http://10.0.0.10:8090/
http://10.0.0.9:8123/
So no https?

Even though it shouldn't matter test the access with health checks disabled.

Correct if I hit those 2 IP's above internally I get the service correctly.
I did have it running with health checks disabled and same result 503 errors

28

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: October 09, 2021, 10:46:19 am »

Thank for taking the time to help.

Code: [Select]

#
# Automatically generated configuration.
# Do not edit this file manually.
#

global
    uid                         80
    gid                         80
    chroot                      /var/haproxy
    daemon
    stats                       socket /var/run/haproxy.socket group proxy mode 775 level admin
    nbproc                      1
    nbthread                    4
    maxconn                     10000
    tune.ssl.default-dh-param   4096
    spread-checks               2
    tune.chksize                16384
    tune.bufsize                16384
    tune.lua.maxmem             0
    log /var/run/log local0 info

defaults
    log     global
    option redispatch -1
    maxconn 5000
    timeout client 30s
    timeout connect 30s
    timeout server 30s
    retries 3
    default-server init-addr last,libc

# autogenerated entries for ACLs


# autogenerated entries for config in backends/frontends

# autogenerated entries for stats




# Frontend: SNI_Frontend ()
frontend SNI_Frontend
    bind 0.0.0.0:443 name 0.0.0.0:443
    bind 0.0.0.0:80 name 0.0.0.0:80
    mode tcp
    default_backend SSL_backend
    # tuning options
    timeout client 30s

    # logging options

# Frontend: HTTP_Frontend ()
frontend HTTP_Frontend
    bind 192.168.64.1:80 name 192.168.64.1:80 accept-proxy
    mode http
    option http-keep-alive
    option forwardfor
    # tuning options
    timeout client 30s

    # logging options
    # ACL: No_SSL_condition
    acl acl_6160768c129757.05678189 req.ssl_ver gt 0

    # ACTION: HTTP_to_HTTPS
    http-request redirect scheme https code 301 if !acl_6160768c129757.05678189

# Frontend: HTTPS_Frontend ()
frontend HTTPS_Frontend
    http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    bind 192.168.64.1:443 name 192.168.64.1:443 accept-proxy ssl curves secp384r1  no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 alpn h2,http/1.1 crt-list /tmp/haproxy/ssl/6160790e8358e2.93807756.certlist
    mode http
    option http-keep-alive
    option forwardfor
    # tuning options
    timeout client 30s

    # logging options

    # ACTION: Public_Subdomain_map_rule
    # NOTE: actions with no ACLs/conditions will always match
    use_backend %[req.hdr(host),lower,map_dom(/tmp/haproxy/mapfiles/61607700a205d2.15896401.txt)]

# Backend: SSL_backend (HAProxy SSL Backend)
backend SSL_backend
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    server SSL_server 192.168.64.1 send-proxy-v2 check-send-proxy

# Backend: homeassistant_backend (Home Assistant Backend)
backend homeassistant_backend
    # health check: homeassistant_tcp_check
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server homeassistant 10.0.0.9:8123 check inter 2s port 8123  ssl verify none

# Backend: jellyfin_backend (Jellyfin Backend)
backend jellyfin_backend
    # health check: jellyfin_http_check
    option httpchk
    http-check send meth OPTIONS uri / ver HTTP/1.0
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server jellyfin 10.0.0.10:8090 check inter 2s port 8090  ssl verify none

The only difference I think I made was to add health checks so I can see if service is UP.
It is showing as UP so that looks good.

And my MAP looks like:

Code: [Select]

# public access subdomains
homeassistant homeassistant_backend
jellyfin jellyfin_backend
Oh one other thing to note is I have dual WAN setup.
I had this on pfSense too and HAProxy was working perfectly fine.
I just had all the external connections go through 1 WAN only which I did again here.

29

Tutorials and FAQs / Re: Tutorial 2021/09: HAProxy + Let's Encrypt Wildcard Certificates + 100% A+ Rating

« on: October 08, 2021, 05:45:47 pm »

Hey all,

Is there a way to tie this in with Cloudflare?
I know ACME can use Cloudflare, but can someone add in where I need to do this for wildcards?

Also I installed the plugins and I don't see LetsEncrypt, rather I see ACME Client, and the settings are a bit different.
Any chance you can update the images?

Also I've tried to follow this to the best of my abilities.
I am getting: 503 Service Unavailable
No server is available to handle this request.

If I click on the padlock it is showing my certificate so I think its hitting right.
I'm doing things for:
homeassistant
jellyfin
radarr
sonarr

All of them say 503.

If I set a backend to maintenance I get Safari can't find the server.
So seems to be hitting it correctly.

Ok not sure what changed but now its no dice. Just server cannot be found

30

21.7 Legacy Series / Re: OPNSense, 21.7, GeoIP, MaxMind, IPv6 aliases error: "Invalid argument. [ALIAS]"

« on: August 02, 2021, 05:47:17 pm »

Thank you for this!