Firewall can't access servers in HA-Proxy, Access from WAN or LAN is working

[creatronics]

Hi,
first: thanks to all of you for providing a great forum for OPNsense.
We have an installation with HA setup and HA-proxy up and running. The only ting I just can't get to work, is to get the firewall to access it's own ha proxy and the server bhind it.

ha runs on a loopback ip 127.1.2.3 to make it independend of the WAN and LAN interfaces, which might change on failover.
A NAT rule redirects all traffic to WAN 80 and 443 to ´the loopback address.

everything is working perfectly except one thing: when I try to do a configuration backup on the master to our internal nextcloud server: nothing. Make it the slave and it accesses the Nextcloud via the master and it's working.
No matter what I tried, I just can't get it to work.

doing a curl -vvv on the nextcloud server gives something like this:

connect to 111.222.333.444 port 443 from 111.222.333.444 port 59859 failed: Connection refused

The OS is trying to create a connection from the WAN IP to the WAN IP (which is a pppoe device btw.)

And no matter what, there are no log entries for NAT or firewall rules. HA-proxy is seeing nothing, too.

Any idea which checkbox is missing?

Thank you all,

Michael

[viragomann]

A NAT rule redirects all traffic to WAN 80 and 443 to ´the loopback address.

So port forwarding is in play here. But this rule might be defined on the WAN or LAN interface and hence only affect traffic entering there.

I guess, there is mo possibility to forward traffic coming from the firewall itself (localhost). Don't know. But maybe it works if you enable NAT reflection in the rule.

Otherwise, is there a real need to have HAproxy listening on loopback?
I have it just on WAN and acess it from inside networks as well.

[creatronics]

Hi @viragomann,
listening to WAN was the solution before we switched to a HA installation based on CARP and master / slave. In this scenario, having HAProxy listen to WAN directly, results in problems on failover, as the PPPOE goes down. HAProxy will stop working and won't restart after failover. This was a recommended solution in some HA post I read.
NAT reflection was already on (sorry, forgot to mention this).
What's bugging me is that even when I add a "catch all" rule as first rule, the requests with curl from the interface itself are not registering in any logs.

[Patrick M. Hausen]

Having HAproxy listen to 0.0.0.0 should work.