Comments on: Installing haproxy load balancing for http and https

By: gaojinbo

gaojinbo — Sat, 06 Feb 2010 04:09:53 +0000

My name is gaojinbo.I come from China.
Your haproxy write very good.Thank you for everything.

By: Vijesh

Vijesh — Wed, 23 Dec 2009 17:56:36 +0000

HAProxy would work great for that.

By: pramod shukla

pramod shukla — Wed, 23 Dec 2009 11:00:09 +0000

Hi,

I have java utilities , like java socket programs which accepts raw string and process it.
I want to deploy that utility to multiple servers and i am looking for a solution to balance the load between these two utilities.
Please tell me if HAProxy is useful to that or not.

By: Vijesh

Vijesh — Tue, 22 Dec 2009 17:23:45 +0000

Jimmy,

You are right the X-Forward-For doesn’t work with tcp. HaProxy doesn’t even send the information.

By: jimmy

jimmy — Tue, 22 Dec 2009 10:57:54 +0000

Did anyone get this last part working?

I wouldn’t have thought that a header (such as X-Forwarded-For could be added when it is an SSL request as this header is HTTP and if the payload is encrypted then it can’t be modified. Is that correct?

Does haproxy even add this header when the mode is ‘tcp’?

By: Pritpal Singh

Pritpal Singh — Tue, 08 Dec 2009 10:29:40 +0000

We will configure HAProxy as a transparent proxy, i.e., it will pass on the original user’s IP address in a field called X-Forwarded-For to the backend web servers. Of course, the backend web servers should log the original user’s IP address in their access logs instead of the IP addresses of our load balancers. Therefore we must modify the LogFormat line in /etc/apache2/apache2.conf and replace %h with %{X-Forwarded-For}i:

Change apache conf file

From:-
#LogFormat “%h %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”" combined

To:-
LogFormat “%{X-Forwarded-For}i %l %u %t \”%r\” %>s %b \”%{Referer}i\” \”%{User-Agent}i\”" combined

By: admin

admin — Sat, 31 Oct 2009 20:05:23 +0000

We can’t do much about the IP address – that’s part of the problem with doing things this way.

By: Greg Villegas

Greg Villegas — Fri, 30 Oct 2009 10:20:19 +0000

I follow the above configuration, it’s working. My only problem is the logs of the back-end server. The ip address of the load balancer is being log and not the client’s ip address. Any idea how to resolve this. Thanks

By: Harry

Harry — Tue, 29 Sep 2009 18:02:20 +0000

I use this with my set up and ended up with this error message when I tried to restart HAproxy

[ALERT] 271/135248 (6335) : parsing [/etc/haproxy/haproxy.cfg:26] : server webserver1 has neither service port nor check port. Check has been disabled.
[ALERT] 271/135248 (6335) : Error reading configuration file : /etc/haproxy/haproxy.cfg

any idea?

By: Shlomo

Shlomo — Tue, 29 Sep 2009 17:38:23 +0000

There is a difference between “terminating” SSL requests and “transparently proxying” SSL requests. Transparently proxying SSL means looking at the TCP/IP packet headers only, without decrypting the SSL contents within. This kind of load balancing is supported by HAProxy – just configure a TCP (”mode tcp”) load balancer, as shown in this article. Terminating SSL means authenticating with the client via SSL and decrypting the traffic into plaintext. When this is performed by the load balancer, the LB needs to use an SSL provider – such as apache’s mod_ssl – to perform these functions. This is not shown in this article.

By: Vijesh

Vijesh — Mon, 28 Sep 2009 20:18:02 +0000

The real client IP is lost with this setup.

By: Paras

Paras — Fri, 25 Sep 2009 07:13:04 +0000

Does it retain the real client IP for https transactions ?

By: Vijesh

Vijesh — Sat, 05 Sep 2009 01:02:10 +0000

Yea, HAProxy doesn’t outright say this as a solution. It is hidden in the documentation though. I use it right now and seems to work great. Good luck.

By: JB

JB — Sat, 05 Sep 2009 00:26:54 +0000

I’ll give it a shot. It’s just strange that of all the articles discussing HA Proxy and SSL, yours is the only one that says HA Proxy supports this. Even HA Proxy’s own website says an additional layer is needed to properly terminate the SSL requests. But like I said, I’ll give it a shot and see what happens. I’ll post my findings one way or the other.

Thanks!

By: Vijesh

Vijesh — Fri, 04 Sep 2009 16:54:41 +0000

SSL is on the web servers themselves. HAProxy forwards all requests via IP to the web servers, so it doesn’t matter if its encrypted traffic. The concept is very similar to a NAT on the clients end, HAProxy acts as a router with this configuration.

By: JB

JB — Fri, 04 Sep 2009 15:59:24 +0000

So in this configuration, are the SSL certificates residing on the web servers and you are simply forwarding on the SSL requests to those servers? Like codemonkey — I’ve read numerous articles that in order to properly handle SSL request on HAProxy load balanced configurations, once must also install Apache with mod_ssl to work in a reverse proxy configuration.

By: Vijesh

Vijesh — Sat, 25 Jul 2009 00:08:42 +0000

Yea, it definitely works. I use it in production right now. It works because of the IP based filtering. All traffic is between the server-endpoint and client, the haproxy system doesn’t get involved in the streams.

By: codemonkey

codemonkey — Fri, 24 Jul 2009 23:34:29 +0000

Does this work? I thought haproxy does not load balance HTTPS connections.

Tried the same. HTTPS does not work. Any ideas?

Thanks.

By: links for 2009-05-02 « Bloggitation

links for 2009-05-02 « Bloggitation — Sat, 02 May 2009 07:03:12 +0000

[...] Load balancing for ssl web servers using haproxy (tags: web cluster 247up sysadmin) Comments (0) [...]