Messages

1

Web Proxy Filtering and Caching / Re: HAProxy IP Based ACL

« on: May 23, 2020, 07:20:59 am »

I seen that after the fact, and was able to play around and figure it out. Also I had placed the IP rule in the backend pool rules section which did not work either, after placing it in with the match rules they started functioning.

thanks for your help!

2

Web Proxy Filtering and Caching / Re: HAProxy IP Based ACL

« on: May 21, 2020, 05:39:16 pm »

Code: [Select]


#
# Automatically generated configuration.
# Do not edit this file manually.
#

global
    # NOTE: Could be a security issue, but required for some feature.
    uid                         80
    gid                         80
    chroot                      /var/haproxy
    daemon
    stats                       socket /var/run/haproxy.socket group proxy mode                                                                                                             775 level admin
    nbproc                      1
    nbthread                    1
    tune.ssl.default-dh-param   2048
    spread-checks               0
    tune.chksize                16384
    tune.bufsize                16384
    tune.lua.maxmem             0
    log /var/run/log local0 info

defaults
    log     global
    option redispatch -1
    timeout client 30s
    timeout connect 30s
    timeout server 30s
    retries 3

# autogenerated entries for ACLs

# autogenerated entries for config in backends/frontends

# autogenerated entries for stats


# Frontend: domain.com ()
frontend domain.com
    bind 0.0.0.0:443 name 0.0.0.0:443 ssl  crt-list /tmp/haproxy/ssl/5ec1ceed0ad                                                                                                            936.61713224.certlist
    mode http
    option http-keep-alive
    option forwardfor
    # tuning options
    timeout client 30s

    # logging options
    # ACL: eir
    acl acl_5ec1ce52a22c11.86005378 hdr(host) -i blah.domain.com
    # ACL: plex
    acl acl_5ec1f1ed6cf9d6.91016871 hdr(host) -i plex.domain.com
    # ACL: hassio
    acl acl_5ec1e0423f9969.01800467 hdr(host) -i jarvis.domain.com
    # ACL: bitwarden
    acl acl_5ec1f963768eb6.70249940 hdr(host) -i pass.domain.com
    # ACL: unifi
    acl acl_5ec1f9da8de383.42775802 hdr(host) -i unifi.domain.com
    # ACL: radarr
    acl acl_5ec1f9ada21918.33541377 hdr(host) -i radarr.domain.com
    # ACL: sonarr
    acl acl_5ec1f9c29b9b33.61902860 hdr(host) -i sonarr.domain.com
    # ACL: jackett
    acl acl_5ec1f986b73ff8.35408048 hdr(host) -i jackett.domain.com

    # ACTION: eir_action
    use_backend test_eir if acl_5ec1ce52a22c11.86005378
    # ACTION: plex
    use_backend plex if acl_5ec1f1ed6cf9d6.91016871
    # ACTION: hassio
    use_backend hassio if acl_5ec1e0423f9969.01800467
    # ACTION: bitwarden
    use_backend bitwarden if acl_5ec1f963768eb6.70249940
    # ACTION: unifi
    use_backend unifi if acl_5ec1f9da8de383.42775802
    # ACTION: radarr
    use_backend radarr if acl_5ec1f9ada21918.33541377
    # ACTION: sonarr
    use_backend sonarr if acl_5ec1f9c29b9b33.61902860
    # ACTION: jackett
    use_backend jackett if acl_5ec1f986b73ff8.35408048

# Frontend: http_to_https ()
frontend http_to_https
    bind 0.0.0.0:80 name 0.0.0.0:80
    mode http
    option http-keep-alive
    option forwardfor
    # tuning options
    timeout client 30s

    # logging options
    # ACL: http
    acl acl_5ec1d5269b4ee9.64132240 req.proto_http

    # ACTION: redirect_to_https
    http-request redirect scheme https code 301 if acl_5ec1d5269b4ee9.64132240


# Backend: acme_challenge_backend (Added by Let's Encrypt plugin)
backend acme_challenge_backend
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server acme_challenge_host 127.0.0.1:43580

# Backend: test_eir ()
backend test_eir
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    # ACL: Local
    acl acl_5ec1c9bc432122.19537709 src_is_local

    # ACTION: Local_Access
    http-request deny if !acl_5ec1c9bc432122.19537709

    http-reuse safe
    server srv_eir_webserver eir.domain.com:80

# Backend: hassio ()
backend hassio
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server doc_hassio 10.0.40.11:8123 check inter 2s

# Backend: plex ()
backend plex
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server doc_plex 10.0.70.100:32400 check inter 2s

# Backend: bitwarden ()
backend bitwarden
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server doc_bitwarden 10.0.70.111:80 check inter 2s

# Backend: jackett ()
backend jackett
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server doc_jackett 10.0.20.89:9117 check inter 2s

# Backend: nzbget ()
backend nzbget
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    # ACL: Local
    acl acl_5ec1c9bc432122.19537709 src_is_local

    # ACTION: Local_Access
    http-request deny if !acl_5ec1c9bc432122.19537709

    http-reuse safe
    server doc_nzbget 10.0.20.81:6789 check inter 2s

# Backend: radarr ()
backend radarr
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server doc_radarr 10.0.70.105:7878 check inter 2s

# Backend: sonarr ()
backend sonarr
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    http-reuse safe
    server doc_sonarr 10.0.70.106:8989 check inter 2s

# Backend: unifi ()
backend unifi
    # health check: Socket
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m
    stick on src
    # tuning options
    timeout connect 30s
    timeout server 30s
    # ACL: Local
    acl acl_5ec1c9bc432122.19537709 src_is_local

    # ACTION: Local_Access
    http-request deny if !acl_5ec1c9bc432122.19537709

    http-reuse safe
    server doc_unifi 10.0.10.40:8443 check inter 2s


3

Web Proxy Filtering and Caching / [SOLVED] HAProxy IP Based ACL

« on: May 18, 2020, 08:28:03 am »

I recently switched to OPNsense, and I for the most part have everything operating smoothly. I am running into issues with HAProxy with regards to limiting what passes through.

I have about 40ish services I have routed through HAproxy and thus far is operating ok. what I would like to do is limit access to a few of them from only the local clients.

I noticed under conditions there is a `Source IP matches specified IP` which when I configure the rule and put it in the backend rules  I could get it to function, but I have 100's of IPs to add which is not a viable option. is it possible to add IP ranges, or subnets?

The other option I tried is `Source IP is Local` but that rule didn't seem to function, I was able to access the server from a number of outside IP's.

does anyone have experience with this type of setup or have any suggestions?

Thanks,

4

General Discussion / WAN and Connection Issues

« on: December 18, 2017, 06:56:17 pm »

Hello All,

I have been having constant issues with my OPNsense and prior to that pfSense. I have a single WAN network with 3 networks all with different subnets.

WAN: 99.x.x.x

LAN 10.0.0.0/23
Guest 10.0.10.0/23
DMZ 10.0.100.0/24

the issue i am having is that my provider has intermittent issues. what happens is my connection will drop and for some reason my WAN will pick up and ip from on of the other networks, usually the DMZ. and my network will remain offline uptill i reboot it a few times.

I do not have WAN switching enabled. and i am not sure why it is picking up these other networks so at last i turn to you all for help. as i am about ready to loose my mind.

let me know what information you need and i will get it to you as soon as i can, I am leaving my residence today  and will not be back until the end of the week. with the internet issues my residence will likely be down the entire time i am gone.

thanks in advance