@flooble wrote:
Hi all, new to haproxy and I'm trying to setup a box to proxy traffic from the internet to our internal Exchange server.
Ideally we simply want to check the FQDN being used in the request is valid, check the path is valid for Exchange services, and decrypt, check, and pass "clean" requests to the backend server using SSL.
Any other requests should just bump to our corporate website.
Are there any glaring issues with the config below please? It appears to work but at our small size it's tricky to test with a real-world load.
global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin stats timeout 30s user haproxy group haproxy daemon # Default SSL material locations ca-base /etc/ssl/certs crt-base /etc/ssl/private # Default ciphers to use on SSL-enabled listening sockets. # For more information, see ciphers(1SSL). This list is from: # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl-default-bind-options no-sslv3 tune.ssl.default-dh-param 2048 maxconn 5000 defaults log global maxconn 5000 mode http option httplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 errorfile 400 /etc/haproxy/errors/400.http errorfile 403 /etc/haproxy/errors/403.http errorfile 408 /etc/haproxy/errors/408.http errorfile 500 /etc/haproxy/errors/500.http errorfile 502 /etc/haproxy/errors/502.http errorfile 503 /etc/haproxy/errors/503.http errorfile 504 /etc/haproxy/errors/504.http listen stats x.x.x.x:4711 mode http stats enable stats hide-version stats uri / frontend webmail_frontend bind x.x.x.x:443 ssl crt /etc/ssl/certs/webmail.pem mode http acl webmail_paths path_beg -i /autodiscover/ /ecp/ /ews/ /exchange/ /exchweb/ /microsoft-server-activesync/ /oab/ /owa/ /public/ /rpc/ /rpcwithcert/ acl webmail_hosts hdr_dom(Host) -i a.b.c.d use_backend webmail_backend if webmail_paths webmail_hosts default_backend webmail_redirect backend webmail_backend mode http option ssl-hello-chk option tcp-check option http-keep-alive balance roundrobin stick-table type ip size 20k expire 15m stick on src timeout server 10m server webmail a.b.c.d x.x.x.x:443 ssl verify none weight 1 check port 443 inter 5000 rise 2 fall 3 backend webmail_redirect mode http redirect location http://www.corp
Posts: 1
Participants: 1