HAProxy: multiple frontends, same bind

haproxy

Is this possible / correct to configure multiple frontends that binds to the same port on HAProxy?

frontend A
    bind :80
    bind :2000-5000
    acl rule_about_A
    use_backend server_A if rule_about_A

frontend B
    bind :80
    acl rule_about_B
    use_backend server_B if rule_about_B

In this use case, the frontend A needs to bind to 80 and to the range 2000-5000. For the frontend B, I don't want to bind it to all of those ports, only to 80.

I thought it would looks clean if I configure it in that way, instead use a single frontend and play with the ACLs, but it seems like that configuration is making HAProxy works wrong – sometimes applies the correct rule and sometimes, not.

Before to join those frontends as a single one, is it possible to use multiple frontends that bind to same ports?

EDIT: BTW, I'm using HAProxy 1.5

Best Answer

No, you can't do this and expect sensible behavior.

The requests for port 80 will arrive seemingly randomly at one front end or the other. The result of such a configuration is undefined, and though not technically i valid, it is for all practical purposes a nonsensical configuration.

All of the rules applying on port 80 (or any port) need to be specified on a single frontend (or a single listen) that is bound to port 80.

Related Solutions

Ssl – HAProxy SSL Farm Options

Kyle,

if you only need fail-over for the SSL part and not load balancing, here's what I suggest. You install haproxy + keepalived + stunnel (patched) on two nodes. Keepalived owns the service address and checks for the presence of the stunnel and haproxy processes to compute its weight so that the node in best shape is the master. Stunnel receives the traffic on port 443 and locally forwards it to haproxy on any port you like. In order for haproxy to log the client's IP address, you need the x-forwarded-for patch for stunnel (you can find it on my site). You'll then tell haproxy to log the x-forwarded-for header.

There is a limitation however. If you support HTTP keep-alive, then stunnel will only add the x-forwarded-for header once, which is a bit problematic. At Exceliance, we've started working on a patch to forward the connection parameters from stunnel to haproxy instead of playing with the x-forwarded-for. That way, haproxy believes it gets its connection from the real client. If you're interested, tell me, we can send it to you once it's complete.

Linux – How to configure HAProxy to route by port without using multiple frontend or listeners

Using a single frontend and multiplexing to the backends is indeed possible. You will be required to add one backend section per backend server, e.g.

backend JabberD1
    tcp-check connect
    tcp-check send PING\r\n
    tcp-check expect string +PONG
    server Server1ZoneD 10.60.30.209:80  check

backend JabberE1
    tcp-check connect
    tcp-check send PING\r\n
    tcp-check expect string +PONG
    server Server1ZoneE 10.60.47.4:80    check

etc.

In your frontend, split the traffic like this

    acl d1 dst_port 5222
    use_backend JabberD1 if d1

etc.

Best Answer

Related Solutions

Ssl – HAProxy SSL Farm Options

Linux – How to configure HAProxy to route by port without using multiple frontend or listeners

Related Topic