Configuring HAProxy on a single WAN IP allows you to route traffic to multiple internal hosts using domain names. This guide covers setting up HTTP and HTTPS frontends with SSL termination, backend server definitions, and essential logging via syslog. It ensures secure access to services like WebDAV or NAS interfaces without requiring unique public IPs for each host.
Understanding the Architecture
When operating behind a single public IP address, the primary challenge is distinguishing between different services based on the requested hostname. HAProxy solves this by inspecting the
SNI (Server Name Indication) field in TLS handshakes or the
Host header in plain HTTP requests. This approach, known as name-based virtual hosting, enables one server to serve multiple domains securely.
The architecture typically involves three main components: a frontend that listens on ports 80 and 443, an ACL (Access Control List) section that routes traffic based on the domain, and backend sections that define the internal IP addresses and ports of your actual servers. For example, if you have a NAS at
192.168.1.50 and a web app at
192.168.1.60, HAProxy directs
nas.example.com to the first and
app.example.com to the second.
Before proceeding, ensure your DNS records point all relevant subdomains to your single WAN IP. If you are experiencing issues accessing services after configuration, refer to our guide on
Why I Can't Access My Web Service on Port 80 to troubleshoot common firewall or binding errors.
Installing and Verifying HAProxy
Most Linux distributions provide HAProxy through their package managers. On Debian or Ubuntu systems, you can install it using:
sudo apt update
sudo apt install haproxy
On CentOS or RHEL, use:
sudo yum install haproxy
Once installed, verify the version and check for syntax errors in the default configuration file located at
/etc/haproxy/haproxy.cfg. The command
haproxy -c -f /etc/haproxy/haproxy.cfg will validate the configuration without starting the service. This step is crucial because even minor syntax errors can prevent the daemon from loading, leading to connectivity failures similar to those described in
Connection to host xxxxxxxxxx at port 22 connection timed out, though the root cause here is software misconfiguration rather than network blocking.
Configuring Frontend and Backends
The core of the configuration lies in defining how traffic enters and exits the proxy. We need two frontends: one for HTTP (port 80) and one for HTTPS (port 443). The HTTP frontend can redirect all traffic to HTTPS to enforce security, while the HTTPS frontend handles SSL termination and routing.
First, define your backends. These specify the internal servers. Assume you have two internal hosts:
nas.local at
192.168.1.10:80 and
web.local at
192.168.1.20:8080.
backend nas_backend
server nas1 192.168.1.10:80 check
backend web_backend
server web1 192.168.1.20:8080 check
Next, configure the HTTP frontend to redirect to HTTPS. This improves security by ensuring all data is encrypted in transit.
frontend http_front
bind *:80
mode http
redirect scheme https code 301 if !{ ssl_fc }
The HTTPS frontend requires SSL certificates. You must place your certificate and private key files in a location accessible by HAProxy, such as
/etc/haproxy/certs/. Combine them into a single PEM file for easier management.
frontend https_front
bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
mode http
# Define ACLs for routing
acl host_nas hdr(host) -i nas.example.com
acl host_web hdr(host) -i web.example.com
# Route traffic to appropriate backends
use_backend nas_backend if host_nas
use_backend web_backend if host_web
This configuration uses
hdr(host) to inspect the HTTP Host header. For HTTPS, HAProxy also checks the SNI extension during the TLS handshake, allowing it to select the correct certificate and backend before the HTTP request is fully received.
SSL Termination and Certificate Management
SSL termination offloads the encryption and decryption overhead from your backend servers to HAProxy. This improves performance on resource-constrained devices like NAS units. To implement this, generate a combined PEM file containing both the certificate and the private key.
cat example.com.crt example.com.key > /etc/haproxy/certs/example.com.pem
chmod 600 /etc/haproxy/certs/example.com.pem
Set permissions to
600 so only the root user can read the private key. When HAProxy starts, it loads these certificates into memory. If you use Let's Encrypt, you can automate renewal using scripts that regenerate the PEM file and reload HAProxy. Ensure your firewall allows inbound traffic on TCP ports 80 and 443. If you suspect blocked ports are causing issues, review troubleshooting steps for connectivity problems.
Logging Configuration
Proper logging is essential for debugging and monitoring. The previous draft incorrectly suggested logging to
/var/log/haproxy.log. The standard and more robust method is to use the system logger (syslog), which handles log rotation and persistence automatically.
Edit the HAProxy configuration to include logging directives in the global and frontend sections.
global
log /dev/log local0
log /dev/log local1 notice
frontend https_front
log global
option httplog
You must also configure rsyslog or syslog-ng to capture HAProxy logs. Create a file in
/etc/rsyslog.d/haproxy.conf:
local0.* /var/log/haproxy.log
& stop
Restart both rsyslog and HAProxy to apply changes. Verify logging by accessing your sites and checking
/var/log/haproxy.log. Each line contains the timestamp, client IP, frontend/backend names, and response codes.
Testing and Validation
After applying the configuration, restart HAProxy with
sudo systemctl restart haproxy. Use
curl -I https://nas.example.com to test headers and redirection. Check the response code; a
301 indicates successful HTTPS redirection from HTTP, while a
200 or
302 on HTTPS indicates successful backend routing. Monitor
/var/log/haproxy.log for any errors during the connection attempt.
Frequently Asked Questions
Can I use HAProxy with self-signed certificates?
Yes, you can use self-signed certificates for internal testing or private networks. Place the self-signed cert and key into a PEM file as described, but note that browsers will display security warnings for users accessing these domains externally unless they manually trust the CA.
How do I add a third backend server?
Define a new backend section with its own server directive, then add a corresponding ACL in the frontend. For example, create
backend db_backend and
acl host_db hdr(host) -i db.example.com, followed by
use_backend db_backend if host_db.
What happens if a backend server goes down?
HAProxy automatically marks the server as down if health checks fail. By default, it uses TCP checks if no HTTP health check URL is specified. Traffic is then routed to other healthy servers in the backend or returns a 503 error if no servers are available.
Does HAProxy support WebSocket connections?
Yes, HAProxy supports WebSockets natively. Ensure your backend application sets the proper headers (
Upgrade and
Connection). HAProxy passes these headers through transparently when using
mode http.
How can I limit requests per IP to prevent abuse?
Use stick-tables and rate limiting features in HAProxy. You can define a stick-table in the frontend to track source IPs and deny requests exceeding a certain threshold within a time window, protecting your backend servers from DDoS attacks.