2021-09-14T21:21:05 haproxy[3256] 80.187.80.8:10670 [14/Sep/2021:21:21:05.818] 0_SNI_frontend SSL_backend/SSL_server 1/0/37 0 -- 1/1/0/0/0 0/0 2021-09-14T21:21:05 haproxy[3256] 80.187.80.8:10670 [14/Sep/2021:21:21:05.818] 1_HTTPS_frontend/192.168.64.1:443: SSL handshake failure 2021-09-14T21:21:01 haproxy[3256] 80.187.80.8:10495 [14/Sep/2021:21:21:01.658] 0_SNI_frontend SSL_backend/SSL_server 1/0/36 0 -- 1/1/0/0/0 0/0 2021-09-14T21:21:01 haproxy[3256] 80.187.80.8:10495 [14/Sep/2021:21:21:01.658] 1_HTTPS_frontend/192.168.64.1:443: SSL handshake failure
Quote from: nullex on September 13, 2021, 10:05:21 pmMy map File currently looks like:Code: [Select]sonarr Sonarr_backendradarr Radarr_backendplex Plex_backendcams Cams_backendOmbi Ombi_backendTautulli Tautulli_backendAny advice as to what I'm doing wrong? Why would some services work and others don't when they're using the same exact config? What's also funny is that if I reconfigure the port and IP on the one of the Real Servers that works (For example, Plex_Server has IP 192.168.1.159:32400, Ombi_server has 192.168.1.159:5055, and I replace Plex_Server port to 5055 and go to Plexi.DOMAIN.com, Ombi pops up like it should. I've cloned new Real servers and Backend Pools while updating the PUBLIC_SUBDOMAINS_map from the working Plex one, but still no go for ALL of my services. I've also discovered that if I modify HAProxy Rules & Checks > Rules > Public_subdomains_map-rule > Default backend pool... and change it to a service that DOESN'T work with the map file.. when I hit apply I'm able to access that service on ANY rendition of my domain, as well as the root domain.com address... And if I leave the services that DO work in the map file (Plex), plex.domain.com displays plex as it should, while the rest of the domain is showing the service that doesn't work on it's own.. which further doesn't make any sense.. The map file is working for some services but not others? Thanks in advance, I'm stumped. Final edit:LMFAO I think I figured out why it wasn't working... so apparently for the map file to work you have to have the first part all lowercase, cannot use any uppercase... So when I changed my map file to:Code: [Select]sonarr Sonarr_backendradarr Radarr_backendplex Plex_backendcams Cams_backendombi Ombi_backendtautulli Tautulli_backendeverything started working...Glad it is working for you know.My first guess where some misconfigured real servers (ports, ssl, ssl-verify).BTW: Your map file is exposing your domain name! You should remove it from the forum post.Also I did a quick scan of your domain using https://dnsdumpster.com. It lists all your subdomains since you created a single "A Record" for each of them. Consider switching to a "Wildcard A Record" in order to hide them!If an attacker can see what services you are running it makes it easier for them to find an attack surface.You can then still create individual a records, f.e. www.domain.tld, since the wildcard a record is resolved after all other a records have been resolved.This is why my tutorial is using a "Wildcard A Record / Subdomain" in the form of "*.domain.tld".
My map File currently looks like:Code: [Select]sonarr Sonarr_backendradarr Radarr_backendplex Plex_backendcams Cams_backendOmbi Ombi_backendTautulli Tautulli_backendAny advice as to what I'm doing wrong? Why would some services work and others don't when they're using the same exact config? What's also funny is that if I reconfigure the port and IP on the one of the Real Servers that works (For example, Plex_Server has IP 192.168.1.159:32400, Ombi_server has 192.168.1.159:5055, and I replace Plex_Server port to 5055 and go to Plexi.DOMAIN.com, Ombi pops up like it should. I've cloned new Real servers and Backend Pools while updating the PUBLIC_SUBDOMAINS_map from the working Plex one, but still no go for ALL of my services. I've also discovered that if I modify HAProxy Rules & Checks > Rules > Public_subdomains_map-rule > Default backend pool... and change it to a service that DOESN'T work with the map file.. when I hit apply I'm able to access that service on ANY rendition of my domain, as well as the root domain.com address... And if I leave the services that DO work in the map file (Plex), plex.domain.com displays plex as it should, while the rest of the domain is showing the service that doesn't work on it's own.. which further doesn't make any sense.. The map file is working for some services but not others? Thanks in advance, I'm stumped. Final edit:LMFAO I think I figured out why it wasn't working... so apparently for the map file to work you have to have the first part all lowercase, cannot use any uppercase... So when I changed my map file to:Code: [Select]sonarr Sonarr_backendradarr Radarr_backendplex Plex_backendcams Cams_backendombi Ombi_backendtautulli Tautulli_backendeverything started working...
sonarr Sonarr_backendradarr Radarr_backendplex Plex_backendcams Cams_backendOmbi Ombi_backendTautulli Tautulli_backend
sonarr Sonarr_backendradarr Radarr_backendplex Plex_backendcams Cams_backendombi Ombi_backendtautulli Tautulli_backend
Im using a Synology NAS + Docker with different services. So they are available on same LAN IP adress, but different Ports....I would llike to setup the "access from internatl network" as on your part 6. I do understand that with my setup I cannot use the unbound split DNS option, as this doesnt work with ports...
So my services IP & port are configured inHAproxy map file. (everything working fine, comming from WAN with certificate)...this server IP for me on LANis 192.168.1.20only using 1st level subdomains like:audio.mydomain.tldphoto.mydomain.tldvideo.mydomain.tldetc...My "LAN" port for opnsense on appliance is 192.168.1.1 and I did used a "virtual IP" as per your tutorial which is 192.168.50.1...Using "hosts overrides in unbound" (not "domain") should my configuration look like this :HOST : audio DOMAIN: mydomain.tldIP: 192.168.1.1
## Automatically generated configuration.# Do not edit this file manually.#global uid 80 gid 80 chroot /var/haproxy daemon stats socket /var/run/haproxy.socket group proxy mode 775 level admin nbproc 1 nbthread 4 maxconn 10000 tune.ssl.default-dh-param 4096 spread-checks 2 tune.chksize 16384 tune.bufsize 16384 tune.lua.maxmem 0 log /var/run/log local0 infodefaults log global option redispatch -1 maxconn 5000 timeout client 30s timeout connect 30s timeout server 30s retries 3 default-server init-addr last,libc# autogenerated entries for ACLs# autogenerated entries for config in backends/frontends# autogenerated entries for stats# Frontend: SNI_Frontend ()frontend SNI_Frontend bind 0.0.0.0:443 name 0.0.0.0:443 bind 0.0.0.0:80 name 0.0.0.0:80 mode tcp default_backend SSL_backend # tuning options timeout client 30s # logging options# Frontend: HTTP_Frontend ()frontend HTTP_Frontend bind 192.168.64.1:80 name 192.168.64.1:80 accept-proxy mode http option http-keep-alive option forwardfor # tuning options timeout client 30s # logging options # ACL: No_SSL_condition acl acl_6160768c129757.05678189 req.ssl_ver gt 0 # ACTION: HTTP_to_HTTPS http-request redirect scheme https code 301 if !acl_6160768c129757.05678189# Frontend: HTTPS_Frontend ()frontend HTTPS_Frontend http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" bind 192.168.64.1:443 name 192.168.64.1:443 accept-proxy ssl curves secp384r1 no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 alpn h2,http/1.1 crt-list /tmp/haproxy/ssl/6160790e8358e2.93807756.certlist mode http option http-keep-alive option forwardfor # tuning options timeout client 30s # logging options # ACTION: Public_Subdomain_map_rule # NOTE: actions with no ACLs/conditions will always match use_backend %[req.hdr(host),lower,map_dom(/tmp/haproxy/mapfiles/61607700a205d2.15896401.txt)] # Backend: SSL_backend (HAProxy SSL Backend)backend SSL_backend # health checking is DISABLED mode tcp balance source # stickiness stick-table type ip size 50k expire 30m stick on src # tuning options timeout connect 30s timeout server 30s server SSL_server 192.168.64.1 send-proxy-v2 check-send-proxy# Backend: homeassistant_backend (Home Assistant Backend)backend homeassistant_backend # health check: homeassistant_tcp_check mode http balance source # stickiness stick-table type ip size 50k expire 30m stick on src # tuning options timeout connect 30s timeout server 30s http-reuse safe server homeassistant 10.0.0.9:8123 check inter 2s port 8123 ssl verify none# Backend: jellyfin_backend (Jellyfin Backend)backend jellyfin_backend # health check: jellyfin_http_check option httpchk http-check send meth OPTIONS uri / ver HTTP/1.0 mode http balance source # stickiness stick-table type ip size 50k expire 30m stick on src # tuning options timeout connect 30s timeout server 30s http-reuse safe server jellyfin 10.0.0.10:8090 check inter 2s port 8090 ssl verify none
# public access subdomainshomeassistant homeassistant_backendjellyfin jellyfin_backend
Please confirm you are accessing your servers internally using:http://10.0.0.10:8090/http://10.0.0.9:8123/So no https?Even though it shouldn't matter test the access with health checks disabled.
