OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • International Forums »
  • German - Deutsch »
  • Haproxy mit 2 Domains
« previous next »
  • Print
Pages: [1]

Author Topic: Haproxy mit 2 Domains  (Read 661 times)

dima1002

  • Newbie
  • *
  • Posts: 27
  • Karma: 0
    • View Profile
Haproxy mit 2 Domains
« on: August 10, 2024, 11:07:03 am »
Hallo Leute,

ich habe einen HAProxy mit 2 Domains. Hier in meinem Beispiel mit

service.de und test-technik.de

Nun soll z.B. bei c.service.de das Zertifikat kommen von service.de, es kommt aber das von test-technik.de.
Warum?

Code: [Select]
# Do not edit this file manually.
#

global
    uid                         80
    gid                         80
    chroot                      /var/haproxy
    daemon
    stats                       socket /var/run/haproxy.socket group proxy mode 775 level admin
    nbthread                    6
    hard-stop-after             60s
    no strict-limits
    tune.ssl.ocsp-update.mindelay 300
    tune.ssl.ocsp-update.maxdelay 3600
    httpclient.resolvers.prefer   ipv4
    tune.ssl.default-dh-param   2048
    spread-checks               2
    tune.bufsize                16384
    tune.lua.maxmem             0
    log                         /var/run/log local0 info
    lua-prepend-path            /tmp/haproxy/lua/?.lua

defaults
    log     global
    option redispatch -1
    timeout client 60s
    timeout connect 60s
    timeout server 60s
    retries 3
    default-server init-addr last,libc

# autogenerated entries for ACLs


# autogenerated entries for config in backends/frontends

# autogenerated entries for stats




# Frontend: Letsencrypt_80 ()
frontend Letsencrypt_80
    bind 192.168.252.253:80 name 192.168.252.253:80
    mode tcp
    default_backend acme_challenge_backend

    # logging options
    # ACL: find_acme_challenge
    acl acl_6546b7f7e92430.59551874 path_beg -i /.well-known/acme-challenge/

    # ACTION: redirect_acme_challenges
    use_backend acme_challenge_backend if acl_6546b7f7e92430.59551874

# Frontend: LetsEncrypt_service.de (LetsEncrypt_service.de)
frontend LetsEncrypt_service.de
    http-response set-header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
    bind 192.168.252.253:443 name 192.168.252.253:443 ssl prefer-client-ciphers ssl-min-ver TLSv1.2 ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 alpn h2,http/1.1 crt-list /tmp/haproxy/ssl/657480646e0916.14570670.certlist
    mode http
    option http-keep-alive

    # logging options
    # ACL: Cloud
    acl acl_6574814183df20.44437889 ssl_fc_sni c.service.de
    # ACL: Bitwarden
    acl acl_6574821b797e36.16475695 hdr(host) -i v.service.de
    # ACL: BItwarden Archiv
    acl acl_6574823ea51b23.44386971 hdr(host) -i archiv.service.de
    # ACL: invoice1
    acl acl_657481f7177426.76902867 hdr(host) -i invoice.service.de
    # ACL: find_acme_challenge
    acl acl_6546b7f7e92430.59551874 path_beg -i /.well-known/acme-challenge/
    # ACL: telefon
    acl acl_65ae234d52eaa2.85527754 hdr(host) -i telefon.service.de
    # ACL: Grommunino1
    acl acl_664c906453f702.68929731 hdr(host) -i mail.service.de
    # ACL: Keycloak
    acl acl_668a627a78cb38.48749184 path_beg -i /auth
    # ACL: Autodiscover
    acl acl_657481df6faa20.35926111 hdr(host) -i autodiscover.service.de
    # ACL: Grommunino2
    acl acl_66aa0b17cdf2b9.22616028 hdr(host) -i mail.service.de

    # ACTION: Cloud
    use_backend Cloud if acl_6574814183df20.44437889
    # ACTION: Bitwarden
    use_backend Bitwarden if acl_6574821b797e36.16475695
    # ACTION: BitwardenArchiv
    use_backend BitwardenArchiv if acl_6574823ea51b23.44386971
    # ACTION: invoice1
    use_backend invoice if acl_657481f7177426.76902867
    # ACTION: redirect_acme_challenges
    use_backend acme_challenge_backend if acl_6546b7f7e92430.59551874
    # ACTION: telefon
    use_backend telefon if acl_65ae234d52eaa2.85527754
    # ACTION: Mailserver
    use_backend Mail1 if acl_664c906453f702.68929731
    # ACTION: Keycloak
    use_backend Keycloak if acl_668a627a78cb38.48749184
    # ACTION: Mail2
    use_backend Mail2 if acl_657481df6faa20.35926111 || acl_66aa0b17cdf2b9.22616028
    # WARNING: pass through options below this line
    redirect scheme https code 301 if !{ ssl_fc }

# Frontend: telefon_5222 ()
frontend telefon_5222
    bind 192.168.252.253:5222 name 192.168.252.253:5222
    mode tcp
    default_backend telefon5222

    # logging options

# Frontend: telefon_5060 ()
frontend telefon_5060
    bind 192.168.252.253:5060 name 192.168.252.253:5060
    mode tcp
    default_backend telefon5060

    # logging options

# Frontend: telefon_5061 ()
frontend telefon_5061
    bind 192.168.252.253:5061 name 192.168.252.253:5061
    mode tcp
    default_backend telefon5061

    # logging options

# Frontend: Mailserver_8443 ()
frontend Mailserver_8443
    bind 192.168.252.253:8443 name 192.168.252.253:8443
    mode tcp
    default_backend Mail2

    # logging options

# Frontend: LetsEncrypt_test-technik.de (LetsEncrypt_test-technik.de)
frontend LetsEncrypt_test-technik.de
    http-response set-header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
    bind 192.168.252.253:443 name 192.168.252.253:443 ssl prefer-client-ciphers ssl-min-ver TLSv1.2 ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 alpn h2,http/1.1 crt-list /tmp/haproxy/ssl/66ad001d7bbba8.47335583.certlist
    mode http
    option http-keep-alive

    # logging options
    # ACL: find_acme_challenge
    acl acl_6546b7f7e92430.59551874 path_beg -i /.well-known/acme-challenge/
    # ACL: invoice2
    acl acl_66acf64f3d9ab6.26511269 hdr(host) -i www.test-technik.de

    # ACTION: redirect_acme_challenges
    use_backend acme_challenge_backend if acl_6546b7f7e92430.59551874
    # ACTION: invoice2
    use_backend invoice if acl_66acf64f3d9ab6.26511269
    # WARNING: pass through options below this line
    redirect scheme https code 301 if !{ ssl_fc }

# Backend: acme_challenge_backend (Added by ACME Client plugin)
backend acme_challenge_backend
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    http-reuse safe
    server acme_challenge_host 127.0.0.1:43580

# Backend: Cloud ()
backend Cloud
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    http-reuse safe
    server Cloud 192.168.211.32:80

# Backend: invoice ()
backend invoice
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    # WARNING: pass through options below this line
    http-request set-header X-Real-IP %[src]
    http-reuse safe
    server invoice 192.168.211.30:443 ssl verify none

# Backend: Bitwarden ()
backend Bitwarden
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    retries 3
    # WARNING: pass through options below this line
    http-request set-header X-Real-IP %[src]
    http-reuse safe
    server Bitwarden 192.168.211.31:8080

# Backend: BitwardenArchiv ()
backend BitwardenArchiv
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    http-reuse safe
    server BitwardenArchiv 192.168.211.73:443 ssl verify none

# Backend: telefon ()
backend telefon
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    http-reuse safe
    server telefon443 192.168.211.5:443 ssl verify none

# Backend: Mail1 ()
backend Mail1
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    cookie KC_ROUTE insert indirect nocache
    # WARNING: pass through options below this line
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Port 443
    http-request set-header X-Forwarded-For %[src]
    option forwardfor
    http-reuse safe
    option forwardfor
    server Mailserver 192.168.211.33:443 ssl alpn h2,http/1.1 verify none cookie 6607c74887063778516557

# Backend: telefon5222 ()
backend telefon5222
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    server telefon5222 192.168.211.5:5222

# Backend: telefon5060 ()
backend telefon5060
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    server telefon5060 192.168.211.5:5060

# Backend: telefon5061 ()
backend telefon5061
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    server telefon5061 192.168.211.5:5061

# Backend: Keycloak ()
backend Keycloak
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    cookie KC_ROUTE insert indirect nocache
    # WARNING: pass through options below this line
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Port 443
    http-request set-header X-Forwarded-For %[src]
    option forwardfor
    http-reuse safe
    option forwardfor
    server Keycloak 192.168.211.33:8080 cookie 668a62bcb6c3f299187837

# Backend: Mail2 ()
backend Mail2
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    cookie KC_ROUTE insert indirect nocache
    # WARNING: pass through options below this line
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Port 443
    http-request set-header X-Forwarded-For %[src]
    option forwardfor
    http-reuse safe
    option forwardfor
    server Mail2 192.168.211.83:443 ssl alpn h2,http/1.1 verify none cookie 66aa0aef4fe2c713022817
    server Mail21 192.168.211.83:8443 ssl alpn h2,http/1.1 verify none cookie 66aa2aaf5fe7c129653610



# statistics are DISABLED
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 6802
  • Karma: 572
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #1 on: August 10, 2024, 11:45:50 am »
Du darfst nur einen Virtual Service für das Frontend definieren, der alle Zertifikate hat, und dann per SNI das richtige Backend auswählt.
Logged
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

dima1002

  • Newbie
  • *
  • Posts: 27
  • Karma: 0
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #2 on: August 10, 2024, 12:05:56 pm »
das hatte ich vorher so und hatte dann Probleme, daher habe ich das getrennt.
SNI habe ich doch aber überall richtig konfiguriert oder?
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 6802
  • Karma: 572
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #3 on: August 10, 2024, 12:30:00 pm »
Es geht prinzipiell nur mit einem Frontend, wenn du nur eine IP-Adresse hast. Stell es um und dann gucken wir uns gerne die anderen Probleme an.

Caddy ist wesentlich weniger komplex und hat SSL mit Letsencrypt gleich eingebaut. Wie wärs damit?
Logged
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

dima1002

  • Newbie
  • *
  • Posts: 27
  • Karma: 0
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #4 on: August 10, 2024, 01:38:20 pm »
Ich habe es nun wieder umgestellt auf ein frontend mit port 443, scheint aber nun doch zu laufen. Dann keine Ahnung was hier das letzte mal war.
Geht Cady auch mit der Opnsense? Wenn ja wie?
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 6802
  • Karma: 572
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #5 on: August 10, 2024, 02:09:02 pm »
Ist doch eingebaut, deshalb der Vorschlag. os-caddy Plugin installieren, freuen  :)
Logged
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

dima1002

  • Newbie
  • *
  • Posts: 27
  • Karma: 0
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #6 on: August 10, 2024, 02:29:28 pm »
ok Danke muss ich mir mal anschauen.
Habe noch ein 2. Problem, bei meiner Telefonie bekomme ich eine Verbindung hin aber keine Sprache. Ist das evtl auch einfacher mit Caddy? oder kannst du hier auch ein Fehler erkennen.
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 6802
  • Karma: 572
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #7 on: August 10, 2024, 02:40:55 pm »
Leitest du Telefonie über den HAproxy? Seit wann kann der UDP? Das musst du m.E. mit NAT machen.
Logged
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

dima1002

  • Newbie
  • *
  • Posts: 27
  • Karma: 0
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #8 on: August 10, 2024, 02:51:13 pm »
Ja, aber nicht ganz. Soll ich dafür einen eigenen Post aufmachen?
Die RTP Ports 10.000-20000 leite ich per NAT direkt zur Telefonanlage

Nur die Ports 443, 5060, 5061 und 5222

5061 und 443 und 5222 nutzen soweit ich weiß TLS, daher hatte ich versucht das durchzuleiten.
Die App startet auch und das Gespräch kann auch angenommen werden, habe wie gesagt nur kein Ton.

Code: [Select]
    # ACTION: redirect_acme_challenges
    use_backend acme_challenge_backend if acl_6546b7f7e92430.59551874
    # ACTION: telefon
    use_backend telefon if acl_65ae234d52eaa2.85527754
 

# Frontend: telefon_5222 ()
frontend telefon_5222
    bind 192.168.252.253:5222 name 192.168.252.253:5222
    mode tcp
    default_backend telefon5222

    # logging options

# Frontend: telefon_5060 ()
frontend telefon_5060
    bind 192.168.252.253:5060 name 192.168.252.253:5060
    mode tcp
    default_backend telefon5060

    # logging options

# Frontend: telefon_5061 ()
frontend telefon_5061
    bind 192.168.252.253:5061 name 192.168.252.253:5061
    mode tcp
    default_backend telefon5061

    # logging options

# Frontend: LetsEncrypt_test-technik.de (LetsEncrypt_test-technik.de)
frontend LetsEncrypt_test-technik.de
    http-response set-header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
    bind 192.168.252.253:443 name 192.168.252.253:443 ssl prefer-client-ciphers ssl-min-ver TLSv1.2 ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 alpn h2,http/1.1 crt-list /tmp/haproxy/ssl/66ad001d7bbba8.47335583.certlist
    mode http
    option http-keep-alive

    # logging options
    # ACL: find_acme_challenge
    acl acl_6546b7f7e92430.59551874 path_beg -i /.well-known/acme-challenge/
    # ACL: invoice2
    acl acl_66acf64f3d9ab6.26511269 hdr(host) -i www.test-technik.de

    # ACTION: redirect_acme_challenges
    use_backend acme_challenge_backend if acl_6546b7f7e92430.59551874
    # ACTION: invoice2
    use_backend invoice if acl_66acf64f3d9ab6.26511269
    # WARNING: pass through options below this line
    redirect scheme https code 301 if !{ ssl_fc }

# Backend: acme_challenge_backend (Added by ACME Client plugin)
backend acme_challenge_backend
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    http-reuse safe
    server acme_challenge_host 127.0.0.1:43580

# Backend: telefon ()
backend telefon
    # health checking is DISABLED
    mode http
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    http-reuse safe
    server telefon443 192.168.211.5:443 ssl verify none

# Backend: telefon5222 ()
backend telefon5222
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    server telefon5222 192.168.211.5:5222

# Backend: telefon5060 ()
backend telefon5060
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    server telefon5060 192.168.211.5:5060

# Backend: telefon5061 ()
backend telefon5061
    # health checking is DISABLED
    mode tcp
    balance source
    # stickiness
    stick-table type ip size 50k expire 30m 
    stick on src
    server telefon5061 192.168.211.5:5061
Logged

Monviech (Cedrik)

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 1599
  • Karma: 176
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #9 on: August 10, 2024, 03:05:36 pm »
Bitte für so eine unheilige Konfiguration weiter HA-Proxy verwenden. Dafür ist Caddy nicht ausgelegt.
Logged
Hardware:
DEC740

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 6802
  • Karma: 572
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #10 on: August 10, 2024, 04:10:14 pm »
@dima1002 Keine Ahnung, ich würde die Telefonie immer komplett über NAT abwickeln, daher weiß ich auch nicht, wie das mit HAproxy geht, sorry.
Logged
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

dima1002

  • Newbie
  • *
  • Posts: 27
  • Karma: 0
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #11 on: August 10, 2024, 05:03:40 pm »
war eigentlich auch meine Idee, aber für die Handyapp benötige ich doch ein Zertifikat vorallem für die 3 Ports.

Die Nutzung von TLS 1.0 und TLS 1.1 ist für die folgenden Ports nicht möglich, alle höheren Versionen von TLS werden unterstützt:

443
5061
5222
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 6802
  • Karma: 572
    • View Profile
Re: Haproxy mit 2 Domains
« Reply #12 on: August 10, 2024, 05:46:48 pm »
Klingt sinnvoll. Hast du für die Anlage ausgehend eine eigene NAT-Regel und "static port" aktiviert?
Logged
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)
  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • International Forums »
  • German - Deutsch »
  • Haproxy mit 2 Domains
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2024 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy     | XHTML | RSS | WAP2