Quantcast
Viewing all 4735 articles
Browse latest View live

Config for clustering

@faryspeed wrote:

hi everyone
i planing to use clustering for my websites . my goal is give my clients best ping in 2 countries .
so i rent 2 dedicated servers in each country and i will setup Cpanel,Mysql and galera for databases .
im new to haproxy !
i think i should setup haproxy and geodns together to redirect every client to near server !
just need help on how to setup haproxy and config it for this project .

thanks all

Posts: 1

Participants: 1

Read full topic


Redirect with query strings

@mchase wrote:

I am running haproxy 1.8.9 and have a need to redirect a url with single sign on query strings. Each member has a unique query string. The config I have now works great with a single string which is…

redirect prefix https://me.domain2.com if { hdr(host) -i me.domain1.io } { path / } { query -i cvt=012dfWs56947 }

But it only works with the one query string. Is there any easy way to set this up for multiple different query strings? Even a variable or wildcard would help because I have 1000’s of different query strings. If it isn’t possible I will need to look for a different alternative. Thanks for the help.

Posts: 5

Participants: 2

Read full topic

How to get integrated request body

@kevin_zhu wrote:

Hi everyone,
I wanna known, how can i get the integrated req body first, then decide drop it or forwarding it to bakcend.
Thanks for any answers.

Regards.
Kevin Zhu

Posts: 1

Participants: 1

Read full topic

How to receive source IP address?

@xohox wrote:

Hello.

Please tell me.

I use a proxy for load balancing (tcp mode, not http) want to initial TCP connection data, including the source IP address, destination IP address and port number, but receive the ip of the balancer.

Set up for this instruction https://www.haproxy.com/blog/using-haproxy-with-the-proxy-protocol-to-better-secure-your-database/ but still receive the ip of the balancer.

Tell me please what should be the settings in haproxy.cfg for obtaining original the source IP address?

Thanks

Ubuntu 16.04.4 LTS
HA-Proxy version 1.6.3 2015/12/25

Posts: 3

Participants: 2

Read full topic

HAproxy configuration

@miroslav wrote:

Hi,

I am facing problem to setup HAproxy when it is needed for different directories in URL to reach different backend systems. So, what is needed is when enter

www.evaplus.com/drs -> to access backend system

Setting I have is following:

acl host_www hdr_beg(host) -i www.evaplus.com
acl drs_hostname path_beg /drs
use_backend backend_drs if host_www drs_hostname
backend backend_drs
mode http
server backend_drs 172.16.2.59:8090

When I try to reach above url with ‘/drs’ , it is not possible.
What is wrong with this setting?

Thank you!
Miroslav

Posts: 1

Participants: 1

Read full topic

Haproxy1.6 modify response body by Lua problem

@cnzzr wrote:

Ubuntu 14 Server with Hparoxy 1.6
My problem is when response’s body size just 505 then browser return ERR_EMPTY_RESPONSE
but when response’s body size big then 2877 return OK.

[WARNING] 157/093512 (14599) : config : log format ignored for frontend ‘http_80_in’ since it has no log address.
[info] 157/093516 (14599) : start debug …
[info] 157/093516 (14599) : in: 505
[info] 157/093516 (14599) : out: 0
[info] 157/093516 (14599) : before send
[info] 157/093516 (14599) : out: 0
[info] 157/093516 (14599) : in: 0
[info] 157/093516 (14599) : end debug …
[info] 157/093520 (14599) : start debug …
[info] 157/093520 (14599) : in: 2877
[info] 157/093520 (14599) : out: 0
[info] 157/093520 (14599) : before send
[info] 157/093520 (14599) : out: 0
[info] 157/093520 (14599) : in: 2877
[info] 157/093520 (14599) : end debug …

lua scripts
core.register_action(“file-get-oa”, { “http-res” }, function(txn)
txn:Info(‘start debug …’)
txn:Info('in: '… txn.res:get_in_len())
txn:Info('out: '… txn.res:get_out_len())

   local json = txn.res:get()
   txn:Info( ' before send')
   txn.res:set(json)
   txn:Info(' out: '.. txn.res:get_out_len())
   txn:Info(' in: '.. txn.res:get_in_len())
   txn:Info('end debug .........')
end)

haproxy.cfg
backend oafile-server
mode http
option http-server-close
http-request replace-header Host ^gys.zxlm.cn$ oa.zxlm.cn

acl htmltxt res.hdr(Content-Type) -m beg text application/json
acl gys var(txn.requesthost) -m str gys.zxlm.cn
http-response lua.file-get-oa if !gys htmltxt
http-response lua.file-get-gys if gys htmltxt

server oa_File_8060 10.219.8.101:8060 check

Posts: 1

Participants: 1

Read full topic

Configuration help for haproxy 1.8.9

@mouseskowitz wrote:

I thought I had my configuration mostly working, but now I’m having issues. I’m running haproxy 1.8.9 on CentOS 7.5.

  1. server4 is NextCloud on CentOS 7.5. It was working and then stopped with no config file changes. I think it broke after updates were applied on both servers. I am able to access the NextCloud web interface from inside the network.
  2. I have not been able to get my Windows 2012 R2 Essentials web page (server1) to forward through HA Proxy. It is accessible locally.
  3. server2 and server3 are accessible from the web, but when I tried to renew a LetsEncrypt cert it wouldn’t work through haproxy. I had to give the server direct access to the web.

How do I fix these issues? My config is a follows:

global
   log /dev/log local0
   log /dev/log local1 notice
   chroot /var/lib/haproxy
   stats timeout 30s
   user haproxy
   group haproxy
   daemon

defaults
   log global
   mode tcp
   option tcplog
   option dontlognull
   timeout connect 5000ms
   timeout client 50000ms
   timeout server 50000ms

frontend https
  bind *:443
  mode tcp
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }

  use_backend server1 if { req_ssl_sni -i subdomain1.domain1.com }
  use_backend server2 if { req_ssl_sni -i subdomain2.domain2.net }
  use_backend server3 if { req_ssl_sni -i subdomain2.domain3.com }
  use_backend server4 if { req_ssl_sni -i subdomain3.domain2.net }


backend server1
  mode tcp
  option ssl-hello-chk
  server server1 192.168.10.31:443 check

backend server2
  mode tcp
  option ssl-hello-chk
  server server2 10.0.40.3:443 check

backend server3
  mode tcp
  option ssl-hello-chk
  server server3 10.0.40.4:443 check

backend server4
  mode tcp
  option ssl-hello-chk
  server server4 10.0.40.6:443 check


frontend http-in
  bind *:80
  mode http

  use_backend server1_http if { hdr(host) -i subdomain1.domain1.com }
  use_backend server2_http if { hdr(host) -i subdomain2.domain2.net }
  use_backend server3_http if { hdr(host) -i subdomain2.domain3.com }
  use_backend server4_http if { hdr(host) -i subdomain3.domain2.net }

backend server1_http
  mode http
  server server1 192.168.10.31:80 check

backend server2_http
  mode http
  server server2 10.0.40.3:80 check

backend server3_http
  mode http
  server server3 10.0.40.4:80 check

backend server4_http
  mode http
  server server4 10.0.40.6:80 check

Posts: 1

Participants: 1

Read full topic

HAproxy for onlyoffice Virtual path

@Danil wrote:

Here is examples for nginx and apache, but I need for haproxy
https://helpcenter.onlyoffice.com/server/document/document-server-proxy.aspx

My haproxy.cfg

global
maxconn 16384
tune.ssl.default-dh-param 2048
log 127.0.0.1 local1 debug
stats socket /var/run/haproxy_info.sock mode 666 level user
stats timeout 2m

defaults
maxconn 16384
timeout client 5s
timeout connect 5s
timeout queue 5s
timeout server 30s
timeout tunnel 1h
log global

frontend cloud
bind *:80
mode http
acl is_oo path_beg /oo
option forwardfor header X-Real-IP
use_backend ooffice if is_oo
default_backend cloudnodes

backend cloudnodes
mode http
balance roundrobin
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
cookie SERVERID insert indirect nocache
server own-01 1.2.3.40:80 check cookie own-01 check inter 1000 rise 1 fall 1
server own-02 1.2.3.41:80 check cookie own-02 check inter 1000 rise 1 fall 1

backend ooffice
mode http
option httpclose
option forwardfor header X-Real-IP
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-For %[src]
http-request set-header X-Client-IP %[src]
http-request set-header X-Forwarded-Proto http
http-request set-header Forwarded proto=http
http-request add-header Host %[src]
http-request add-header X-Forwarded-Host %[src]
http-request add-header X-Forwarded-Server %[src]
reqrep ^([^\ :])\ /oo(.) \1\ \2
server oo-01 1.2.3.4:80

Posts: 1

Participants: 1

Read full topic


How to analyse SNI support by client base

@jurgenhaas wrote:

We are using HaProxy in front of a webserver farm for many different domains which are all delivered over HTTPS, HaProxy is running in http mode.

As we started many years ago where SNI was not yet supported by IE and a few other platforms, we decided to get individual IP addresses for each SSL certificate. But we’re adding mor SSL certs regularely and now consider to expect SNI to be supported widely enough so that we could combine many certs on a single IP address.

It sounds like only Windows XP is being left out and still present. But we would also like to analyse our own traffic to see how many clients were still connecting to our farm not supporting SNI.

Is there an easy way to analyse live traffic for SNI support without interrupting the operations?

Posts: 5

Participants: 2

Read full topic

Route http-request based on destination IP

@raaj4smile wrote:

Hi,

Our application makes internal calls to multiple domains and subdomains. The domain names are resolved ( from /etc/hosts file within application servers) by multiple load balancer IPs. I have around 500 websites resolved to different LB IPs with a different backend for each ip. I want to route the request to different backend based on the destination ip ( LB ip) but my requests from the application servers would be to the domains/subdomains.

I can route the traffic based on the domain like below.

frontend https-in
acl host_1 hdr(host) -i www.domain1.net
acl host_2 hdr(host) -i www.domain2.net
use_backend worker_1 if host_1
use_backend worker_2 if host_2

But this way, I have to write 1000 of ACLs as per my current requirement. Is there an option to route based on the destination ip? or any other feature that helps to achieve this as simple as possible?

Thanks in Advance,
Nagaraj

Posts: 2

Participants: 2

Read full topic

Haproxy uses a lot of memory with many backend servers

@ceecko wrote:

Running haproxy with just a single backend with many servers uses considerable amount of memory without any traffic.

The following config makes haproxy use 400MB of memory:

backend bk
  server-template server 1-10000 127.0.0.1:1024 check disabled

On average it’s 41KB / server which seems quite high.
Is there anything I’m missing to be able to reduce the memory footprint?

Posts: 1

Participants: 1

Read full topic

HAProxy redirects when it should not

@tamal wrote:

Hi,
I have the following haproxy config where I don’t want to redirect from http to https for /.well-known/acme-challenge/. But for all other paths I want to redirect from http to https. But it seems that it is getting redirected for all paths including /.well-known/acme-challenge/ . Can you help me understand what I am doing wrong here?

haproxy.cfg:
----
# HAProxy configuration generated by https://github.com/appscode/voyager
# DO NOT EDIT!
global
  daemon
  stats socket /tmp/haproxy
  server-state-file global
  server-state-base /var/state/haproxy/
  # log using a syslog socket
  log /dev/log local0 info
  log /dev/log local0 notice
  tune.ssl.default-dh-param 2048
  ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
defaults
  log global
  # https://cbonte.github.io/haproxy-dconv/1.7/configuration.html#4.2-option%20abortonclose
  # https://github.com/appscode/voyager/pull/403
  option dontlognull
  option http-server-close
  # Timeout values
  timeout client 50s
  timeout client-fin 50s
  timeout connect 50s
  timeout server 20m
  timeout tunnel 50s
  # Configure error files
  # default traffic mode is http
  # mode is overwritten in case of tcp services
  mode http
frontend http-0_0_0_0-80
  bind *:80
  mode http
  option httplog
  option forwardfor
  acl is_proxy_https hdr(X-Forwarded-Proto) https
  acl acl_:.well-known-acme-challenge path_beg /.well-known/acme-challenge/
  use_backend voyager-operator.voyager:56791 if  acl_:.well-known-acme-challenge
  acl acl_search-rpc-kube.example.com hdr(host) -i search-rpc-kube.example.com
  acl acl_search-rpc-kube.example.com hdr(host) -i search-rpc-kube.example.com:80
  use_backend production-rpc.production-rpc:80 if acl_search-rpc-kube.example.com
  acl acl_nextcloud.example.com hdr(host) -i nextcloud.example.com
  acl acl_nextcloud.example.com hdr(host) -i nextcloud.example.com:80
  use_backend nextcloud.nextcloud:80 if acl_nextcloud.example.com
  acl acl_internal-services.example.com hdr(host) -i internal-services.example.com
  acl acl_internal-services.example.com hdr(host) -i internal-services.example.com:80
  use_backend graphie-to-png.graphie-to-png:8765-ebc10c77500be47b8c6f25c6a9db26f6 if acl_internal-services.example.com
  acl acl_graphie-to-png.kasandbox.org hdr(host) -i graphie-to-png.kasandbox.org
  acl acl_graphie-to-png.kasandbox.org hdr(host) -i graphie-to-png.kasandbox.org:80
  use_backend graphie-to-png.graphie-to-png:8765-16e12e4030e576bb5d488b97792cecc9 if acl_graphie-to-png.kasandbox.org
  acl acl_error-monitor-db.example.com hdr(host) -i error-monitor-db.example.com
  acl acl_error-monitor-db.example.com hdr(host) -i error-monitor-db.example.com:80
  redirect scheme https code 308 if ! is_proxy_https acl_error-monitor-db.example.com
  acl acl_crowdin-gcs-sync.example.com hdr(host) -i crowdin-gcs-sync.example.com
  acl acl_crowdin-gcs-sync.example.com hdr(host) -i crowdin-gcs-sync.example.com:80
  redirect scheme https code 308 if ! is_proxy_https acl_crowdin-gcs-sync.example.com
  acl acl_buildmaster.example.com hdr(host) -i buildmaster.example.com
  acl acl_buildmaster.example.com hdr(host) -i buildmaster.example.com:80
  redirect scheme https code 308 if ! is_proxy_https acl_buildmaster.example.com
  acl acl_alerta.example.com hdr(host) -i alerta.example.com
  acl acl_alerta.example.com hdr(host) -i alerta.example.com:80
  redirect scheme https code 308 if ! is_proxy_https acl_alerta.example.com```
backend voyager-operator.voyager:56791
  server pod-voyager-operator-5d4cc8948f-qffjc 10.4.0.126:56791
backend production-rpc.production-rpc:80
  server pod-production-rpc-b584c5769-sldgc 10.128.0.8:80
backend nextcloud.nextcloud:80
  server pod-nextcloud-6c4f588755-czfxg 10.128.0.3:80
backend graphie-to-png.graphie-to-png:8765-ebc10c77500be47b8c6f25c6a9db26f6
  server pod-graphie-to-png-76dfbd5549-27htk 10.128.0.7:8765
backend graphie-to-png.graphie-to-png:8765-16e12e4030e576bb5d488b97792cecc9
  server pod-graphie-to-png-76dfbd5549-27htk 10.128.0.7:8765
frontend http-0_0_0_0-443
  bind *:443  ssl no-sslv3 no-tlsv10 no-tls-tickets crt /etc/ssl/private/haproxy/tls/  alpn http/1.1
  # Mark all cookies as secure
  rsprep ^Set-Cookie:\ (.*) Set-Cookie:\ \1;\ Secure
  # Add the HSTS header with a 6 month default max-age
  http-response set-header Strict-Transport-Security max-age=15768000
  mode http
  option httplog
  option forwardfor
  acl is_proxy_https hdr(X-Forwarded-Proto) https
  acl acl_error-monitor-db.example.com hdr(host) -i error-monitor-db.example.com
  acl acl_error-monitor-db.example.com hdr(host) -i error-monitor-db.example.com:443
  use_backend error-monitor-db.error-monitor-db:9340 if acl_error-monitor-db.example.com
  acl acl_crowdin-gcs-sync.example.com hdr(host) -i crowdin-gcs-sync.example.com
  acl acl_crowdin-gcs-sync.example.com hdr(host) -i crowdin-gcs-sync.example.com:443
  use_backend crowdin-gcs-sync.crowdin-gcs-sync:9999 if acl_crowdin-gcs-sync.example.com
  acl acl_buildmaster.example.com hdr(host) -i buildmaster.example.com
  acl acl_buildmaster.example.com hdr(host) -i buildmaster.example.com:443
  use_backend buildmaster.buildmaster:80 if acl_buildmaster.example.com
  acl acl_alerta.example.com hdr(host) -i alerta.example.com
  acl acl_alerta.example.com hdr(host) -i alerta.example.com:443
  use_backend alerta.alerta:8080 if acl_alerta.example.com
backend error-monitor-db.error-monitor-db:9340
  server pod-error-monitor-db-cb7bbcdb8-4sdrs 10.128.0.3:9340
backend crowdin-gcs-sync.crowdin-gcs-sync:9999
  server pod-crowdin-gcs-sync-5b684f687-xv87k 10.128.0.4:9999
backend buildmaster.buildmaster:80
  server pod-buildmaster-cb8cbc586-mf9hm 10.128.0.2:80
backend alerta.alerta:8080
  server pod-alerta-fbbdbbc9c-b5rh4 10.128.0.7:8080
frontend tcp-0_0_0_0-3322
  bind *:3322
  mode tcp
  default_backend scp.scp:3322
backend scp.scp:3322
  mode tcp
  server pod-scp-9d464fd77-pcbwj 10.128.0.7:3322

~ $ curl -vv http://alerta.example.com/.well-known/acme-challenge/4QN4jFM7lrp1AxdX7DOapUmleelvzeZJKA5fYCW_kA8
*   Trying 35.184.192.240...
* TCP_NODELAY set
* Connected to alerta.example.com (35.184.192.240) port 80 (#0)
> GET /.well-known/acme-challenge/4QN4jFM7lrp1AxdX7DOapUmleelvzeZJKA5fYCW_kA8 HTTP/1.1
> Host: alerta.example.com
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 308 Permanent Redirect
< Content-length: 0
< Location: https://alerta.example.com/.well-known/acme-challenge/4QN4jFM7lrp1AxdX7DOapUmleelvzeZJKA5fYCW_kA8
< 
* Connection #0 to host alerta.example.com left intact

Posts: 1

Participants: 1

Read full topic

How to check all haproxy slave processes are ready after startup

@coolhongly wrote:

Hi,

We are using haproxy for SSL offloading. We use master-slave mode and nbproc is set to 8. All 8 slave processes forward HTTP requests to the same backend. My question is, after starting haproxy, how can I know if all the slave processes are “ready” to serve requests? Does haproxy expose any interface I can poke for this kind of check?

Thanks,
Hongli

Posts: 1

Participants: 1

Read full topic

Haproxy deterministic persistence cookie

@ajurna wrote:

i have two servers that i want to balance. i want to use a consistent hashing method to balance them accross both servers. if one server goes down i want all customers on this server to fail over to the other, but i also want them to return once the server comes back online. this happens often enough that a stick table would just cause all the traffic to be sent to the other server for rest of the day.

The second part of this is that we need each customer to be on the same server. so customer 1 would have 5 users and they should be using the same backend server. as you can probably tell we don’t have a stateless design and there are some state issues that require this.

below is my ideal config. but obviously doesn’t work. my idea was to set a cookie from the web app per customer and have that be hashed so as to indicate which server they log into.

backend servers
    hash-type consistent sdbm
    balance req.cook(server_indicator)
    server s8000 127.0.0.1:8000 check
    server s8001 127.0.0.1:8001 check

Posts: 1

Participants: 1

Read full topic

Url based routing

@harneet463 wrote:

Hello All,

Greetings !

I have a very basic setup and am trying to use haproxy as reverse proxy to route requests to different servers based on my urls.

global
log 127.0.0.1 local2 info
pidfile /run/haproxy.pid
daemon

Default SSL material locations

ca-base /etc/ssl/certs
crt-base /etc/ssl/private

defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000

listen stats
bind *:1936
stats enable
stats uri /
stats hide-version
stats auth admin:admin

frontend http
bind *:5000
mode http
default_backend srvc_default

acl workspace path_end -i /cb
use_backend srvc_workspace if workspace

#http-request set-path / if workspace

backend srvc_workspace
balance roundrobin
server server1 myapp
mode http
cookie QPP prefix

backend srvc_default
balance roundrobin
#server qppworkspace qppworkspace:3000
server qppworkspac google.com
listen default
bind *:4242

My sample configuration is shown above.

If I hit the url server/cb, it takes me to the desired server but appends /cb to that url, so essentially I get an error 404 as myserver/cb does not exist.

I just want to route the request if my path contains /cb but /cb should not be part of the final url that reaches my back end.

Thanks again for helping

Regards,
Harneet

Posts: 1

Participants: 1

Read full topic


HAProxy downtime until the IP is moved

@moscardo wrote:

Hi,
I know that this is rather a keepalived question, but I am just wondering how you guys are dealing with this.

I have the two instances checking for haproxy process every second and after 3 failed attempts failing over the backup instance, which means 4 seconds of downtime … How are you guys dealing with this? What would be the configuration for the ALOHA appliance for example?

Thanks.

Posts: 1

Participants: 1

Read full topic

HAPROXY 1.8.9 compled with USE_SYSTEMD=1 make h2 bad request

@rickei wrote:

Hi All,

I’ve build haproxy 1.8.9 in centos 7.5.1804

make TARGET=linux2628 ARC=x86_64 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1 USE_CRYPT_H=1 USE_LIBCRYPT=1

in my harpoxy.cfg
frontend HTTP-IN
bind *:80
bind *:443 ssl crt /etc/haproxy/certs/ps.pem ca-file /etc/haproxy/certs/gd_bundle-g2-g1.crt alpn h2,http/1.1
mode http
maxconn 100000
option http-keep-alive
option forwardfor
option httpclose

I add a “h2” in bind 443 line, however, it doesn’t work, the browser return 400 BAD REQUEST (chrome 66.0.3359.181 or firefox 60.0.2 , but IE 11 works fine)
however , if I make taget without “USE_SYSTEMD=1”, it works fine, any idea why?

Thanks for any help!!!

Regards,
rickei

Posts: 2

Participants: 1

Read full topic

HAProxy for VMWare Horizon Connection servers

@moscardo wrote:

Hi,
I would like to run the 2 Horizon connection servers behind the LB, but as far as I know, only source balance algorithm will do the job, since I have to authenticate and there is no cluster mode, right?

I’ve tried this:

backend 3dcloudtest_ssl_back
  mode http
  balance source
  option httpchk  HEAD / HTTP/1.1\r\nHost:\ 3dcloudtes
  retries 2
  timeout connect 5s
  timeout server 31s
  server hor-conn01 10.11.5.139:443 check inter 5s fall 4 rise 3 ssl verify none
  server hor-conn02 10.11.5.138:443 check inter 5s fall 4 rise 3 ssl verify none

but if my connection is sent to server hor-conn01 and then it fails, I am redirected to hor-conn02 and I need to reauthenticate, but the problem is also that when hor-conn01 comes back online, I am redirected back to hor-conn01 having to reauthenticate once more. How could I avoid this las redirection?

Thanks.

Posts: 1

Participants: 1

Read full topic

Tcp proxy not working

@getmesmerized wrote:

Following is the configuration for the proxy (IPs in logs modified for privacy):

   global
   log /dev/log local0
   log /dev/log local1 notice
   chroot /var/lib/haproxy
   #stats timeout 30s
   #user haproxy
   #group haproxy
   daemon

defaults
   log global
   mode tcp
   option tcplog
   option dontlognull
   option logasap
   timeout connect 50000
   timeout client 50000
   timeout server 50000

listen stats
        maxconn 1000000
        bind 0.0.0.0:8081
        stats enable
        mode http
        stats realm Haproxy\ Statistics  # Title text for popup window
        stats uri /stats  # Stats URI
        stats auth stats:stats  # Authentication credentials

frontend local
        bind *:1900
        bind *:443
        tcp-request connection expect-proxy layer4 if { src -f /etc/haproxy/proxies.lst }
        mode tcp
        default_backend nodes

backend backnodes
        mode tcp
        balance roundrobin
        source 0.0.0.0 usesrc clientip
        server one 10.10.10.10:1900 check

proxies.lst has a single line 1.1.1.1

Clients are unable to connect, if I check logs I see the following line,

Jun 11 10:46:39 udasddg0 haproxy[16981]: 1.1.1.1:51000 [11/Jun/2018:10:43:19.855] local backnodes/one 1/-1/+200005 +0 sC 31/31/30/30/3 0/0

From what I understand:

sC means server timed out and client reset the connection after that
also looks like Tc= -1 which means that the actual server did not respond to the proxy.

If I follow tcp stream in wireshark on the proxy server I see that we are receiving the proxy info:

PROXY TCP4 2.2.2.2 3.3.3.3 53889 1900

Not sure why the connections are failing. Any suggestions would be appreciated.

Posts: 1

Participants: 1

Read full topic

Stats and multiprocessing + multithreading in same time

@arash wrote:

Hello

Im using Haproxy with both nbproc and nbthread.
this is my configuration :

nbproc 6
nbthread 8
cpu-map auto:1/1-8 0-7
cpu-map auto:2/1-8 8-15
cpu-map auto:3/1-8 16-23
cpu-map auto:4/1-8 24-31
cpu-map auto:5/1-8 32-39
cpu-map auto:6/1-8 40-47

this command confirms I have 48 threads with 1 master
ps -efL | grep haproxy | grep -v exporter | grep -v grep | wc -l

the problem is statistics, I don’t have a valid statistics with the following configuration :

listen stats-Static
 bind *:4444
 stats uri /Static-stats
 bind-process 5
 stats enable
 stats scope front-http
 stats scope Static
 stats hide-version
 stats show-legends

I even trying this on stats but its not working

 bind-process 5/1-8
 bind-process 5/32-39

How can I get every threads in process statistics ?
and another question is healthcheck is per thread or per process ?

thank you

Posts: 1

Participants: 1

Read full topic

Viewing all 4735 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>