Source
r/OPNsenseFirewall•
ashfsd

opnsense, haproxy and issues trying to get haproxy to listen on 443

Hi folks, back with another pfsense > opnsense migration query please, this time regarding haproxy, the opnsense web gui, HTTPS and a virtual IP.

Config looks like this: opensense LAN IP: 10.0.0.1 opnsense virtual IP (alias), for haproxy: 10.0.0.20

NAT rule (IPv4 only) Source: defined alias of a specific external IP protocol: tcp/udp Destination: WAN address dest port: HTTPS redirect to: haproxy alias redirect port: HTTPS filter rule: add/linked/managed by NAT rule

Opnsense setting: System > Settings > Administration: TCP port: 443 Listen Interfaces: LAN, or All (tried both, same result)

Looking at ifconfig I can see the haproxy virtual IP associated with igb2 (LAN), however it seems that the web GUI forcibly takes over the port on all IP's on the interface and results in haproxy being unable to use it, and if i launch a request from the NAT'ed external IP I get the dns rebind attack detected page. Disabling the rebind protection of course just results in the firewall login page loading - not what I want.

Firewall log shows the traffic being passed to the virtual IP, so this doesn't seem like a firewall rule problem, and I can't choose an IP address for the web GUI to listen on - I am curious to see how others solve this.

Ideal outcome for me would be to have the web gui listen on 10.0.0.1:443 and not on 10.0.0.20:443, leaving it available for haproxy. Is the only solution here to have the web gui listen on a different port?

thanks in advance...

Posted Mar 22, 2021, 10:29 AM UTC

26
blaktronium•

I have my webui on 8043 and use haproxy to publish 127.0.0.1:8043 to my firewalls internal dns name.

1
[deleted]•

[removed]

1
blaktronium•

Excellent bot. Learned a lot today and I'm not even done my coffee.

1
MischievousM0nkey•

I don't know the answer, but have you tried making your virtual ip to be in a different subnet/interface than your LAN interface? Fundamentally, you have two servers on the same port on the same interface (LAN), so I'm not sure that will ever work.

I'm also not sure you need to port forward from wan to haproxy. I would think that you can set the web GUI to not listen on the wan, so haproxy can be on 443 on wan, and web GUI can be on 443 on LAN.

1
ashfsdOP•

I'm also not sure you need to port forward from wan to haproxy. I would think that you can set the web GUI to not listen on the wan, so haproxy can be on 443 on wan, and web GUI can be on 443 on LAN.

I only have a /32 on IPv4, hence (assuming) needing to do NAT. On my previous config on pfsense I had the VIP on the LAN interface and it worked alright. I suppose I could do away with the NAT and put the VIP on WAN. As a test I tried putting the VIP on loopback, keeping the same IP, and through a restart of haproxy it seems to still work, so will see how that goes and if need be try moving the VIP to WAN. thanks!

1
MischievousM0nkey•

I don't know the NAT settings needed for haproxy. I would think nothing is needed since it's listening on the wan directly.

Why don't you try putting your haproxy virtual ip on a different interface and subnet than your LAN, then add outbound NAT for that interface. Then set the web GUI to only listen on LAN interface, and not the haproxy interface.

1