Deathbybandaid: Created page with " =HAProxy ports 80/443= ==pfsense admin port change== Step one here is to change pfsense admin interface port from 443. pfsense Admin Port Change ==Adjust Firewall Rules== In order for HAProxy to be used, we need to change some firewall rules to pass traffic for 80/443 ===If you previously NATted 80/443=== You will want to disable these NAT rules. File:pfsense-removenat.png ===Adjust WAN rules to allow access=== Add these rules to allow access to HAProxy File..."

2021-12-08T20:16:23Z

Created page with " =HAProxy ports 80/443= ==pfsense admin port change== Step one here is to change pfsense admin interface port from 443. pfsense Admin Port Change ==Adjust Firewall Rules== In order for HAProxy to be used, we need to change some firewall rules to pass traffic for 80/443 ===If you previously NATted 80/443=== You will want to disable these NAT rules. File:pfsense-removenat.png ===Adjust WAN rules to allow access=== Add these rules to allow access to HAProxy File..."

New page

=HAProxy ports 80/443=
==pfsense admin port change==
Step one here is to change pfsense admin interface port from 443. [[pfsense Admin Port Change]]
==Adjust Firewall Rules==
In order for HAProxy to be used, we need to change some firewall rules to pass traffic for 80/443
===If you previously NATted 80/443===
You will want to disable these NAT rules.

[[File:pfsense-removenat.png]]
===Adjust WAN rules to allow access===
Add these rules to allow access to HAProxy

[[File:pfsense-haproxy_rules.jpg]]
=HAProxy setup=
Go to your package manager and download and install HAproxy.

[[File:pfsense-ha_pre_settings.png]]

Make sure the above settings are set.
=Create Basic HTTP site=
Below, we will demonstrate a simple Port 80 access to a dummy webpage. I'd recommend a dummy nginx setup on another device.
==Create First Backend==
Here, we will create a Backend that goes to a dummy webpage (set this up on a seperate device)

[[File:pfsense-backend-default.jpg]]
==Create Shared HTTP Frontend==
There are only a few settings to change here:

[[File:pfsense-shared-front-http-a.jpg]]

Then scroll to the bottom and change the following:

[[File:pfsense-shared-front-http-b.jpg]]
==Create a host matching frontend==
We will now utilize the shared frontend to match a requested host name and direct that traffic to the backend that we setup.

[[File:pfsense-shared-front-hostmatch-a.jpg]]

[[File:pfsense-shared-front-hostmatch-b.jpg]]
==Test==
Assuming you've already directed the A Record for your domain name to you external IP, opening your domain name in a browser should now show your test webpage.
=Upgrade Basic HTTP site to HTTPS=
Now that we have a basic HTTP site functioning, we will add a certificate to HAProxy and allow HTTPS traffic on port 443.
==Obtain Certificate==
For this setup I will focus on using Acme Letsencrypt to obtain a certificate. There are other ways to add a cert to your haproxy setup.

See https://docs.netgate.com/pfsense/en/latest/certificates/certificate-management.html
==Create Acme cert Backend==
[[File:pfsense-acme-backend.jpg]]

MAKE SURE HEALTH CHECKS ARE DISABLED
==Create Frontend Rule to use Acme Backend==
For ease of copy-paste,

<code> /.well-known/acme-challenge/ </code>

[[File:pfsense-acme-frontend-a.jpg]]

[[File:pfsense-acme-frontend-b.jpg]]
==Use The Acme package to get a cert==
===Install and prepare Acme===
[[pfsense acme]]
===Restart HAProxy===
==Create Shared HTTPS Frontend==
Now that we have a working Certificate, we'll add a shared fronend similar to the HTTP one before.

[[File:pfsense-shared-front-https-a.jpg]]

[[File:pfsense-shared-front-http-b.jpg]]

[[File:pfsense-shared-front-https-b.jpg]]

[[File:pfsense-shared-front-https-c.jpg]]
==Copy Acme ACL from HTTP to HTTPS==
For good measure, we'll copy the acme rule to the shared HTTPS frontend

(The rectangle icon is the copy button)

[[File:pfsense-acme-copy-https-a.jpg]]

[[File:pfsense-acme-copy-https-b.jpg]]
==Create an ACL for the shared HTTP frontend to permanently redirect traffic from 80 to 443==
Now we will want all HTTP traffic to use HTTPS on port 443:

[[File:pfsense-http-to-https-a.jpg]]

[[File:pfsense-http-to-https-b.jpg]]
==Move Domain Matched ACL to HTTP==
Go to edit the previously created Frontend for your dummy webserver.

Change the "Primary Frontend" from "Shared-HTTP" to "Shared-HTTPS"
==Test==
You should now be able to open your domain in a browser to see your dummy webpage with HTTPS.
=Frontend ACL Tricks=
These ACLs can be applied to both HTTP and HTTPS frontends
==Blocks==
===Block access by IP Address===
Using Host-Regex matching with http-request-deny 403:

IPv4

<code> ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$ </code>

IPv6

<code> (([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])) </code>
===Block access by Charter Spectrum Address===
Using Host-Regex matching with http-request-deny 403:

<code> .spectrum.com </code>

<code> .charter.com </code>
===Block access by Hurricane Electric Address===
Using Host-Regex matching with http-request-deny 403:

<code> .ipv6.he.net </code>
===Set a robots.txt globally===
====Lua Script====
Under the "Files" tab of HAProxy, create a filename "robots" with the type "Lua script" with the following content
<nowiki>
robots = function(applet)
local response = "User-agent: *\nDisallow: /"
applet:add_header("Content-Length", string.len(response))
applet:add_header("Content-Type", "text/plain")
applet:set_status(200)
applet:start_response()
applet:send(response)
end

core.register_service("robots", "http", robots)
</nowiki>
====Frontend ACL====
[[File:pfsense-robotstxt.jpg]]
==Other==
===Redirect Naked Domains to www.domain.net===
Use a Custom-acl with "Not" checked with a value of:

<code> hdr_reg(host) -i .*\..*\..* : </code>

Then use http-request-redirect

<code> prefix https://www.%[hdr(host)] code 301 </code>
=Backend ACL Tricks=
==Rewrite / to /somethingelse/==
Use Path-Matches to http-request-redirect

<code> prefix https://%[hdr(host)]/somethingelse/ code 301 </code>

Pfsense HAProxy - Revision history