HAProxy block all IPs except a small collection
reddit / selfhosted

----------------------------------------------------------------------
BouncyPancake · 2023-10-24 04:02

frontend main_ssl
            bind *:443
            mode tcp
            option tcplog

            # Wait for a client hello for at most 5 seconds
            tcp-request inspect-delay 5s
            tcp-request content accept if { req_ssl_hello_type 1 }


            use_backend cloud_ssl if { req_ssl_sni -i
cloud.example.com }
            use_backend rproxy_ssl if { req_ssl_sni -i
assets.example.com }
            use_backend rproxy_ssl if { req_ssl_sni -i
support.example.com }
            use_backend manage_ssl if { req_ssl_sni -i
management.example.com }


    backend cloud_ssl
            mode tcp
            balance roundrobin
            server cloud_ssl_server 10.10.5.8:443 check

    backend rproxy_ssl
            mode tcp
            balance roundrobin
            server rpoxy_ssl_server 10.10.5.40:443 check

    backend manage_ssl
            mode tcp
            balance roundrobin
            server manage_ssl_server 10.10.5.2:443 check

​

​

Is it possible to get 'manage\_ssl' to block all IP addresses except
for a small collection in a file or such?

I know that there is some documentation and quite a few Stack Overflow
posts but I seem to be lacking an understanding of the syntax / format
that this stuff needs to be in.

​

​

and no, I can't just block at the whole proxy level, nor can I do it
at the firewall level. The other sites have to be reachable by all
users, it's just one domain that needs to be blocked and IPs
whitelisted for.

----------------------------------------------------------------------
ElevenNotes · 2023-10-24 05:12

I love haproxy probably more than most, but may I suggest only using
it as a TCP proxy? For HTTP, traefik and nginx are way better suited
and offer way better options to block IP ranges or countries and such.

----------------------------------------------------------------------
BouncyPancake · 2023-10-24 07:48

HAProxy in this config isn't using the layer 7 function, it's
literally a TCP proxy in this. It sends traffic to an Nginx proxy
behind it for two of the domains, and the other two domains are being
used for other services which aren't HTTPS / HTTP.

In the config, it says mode tcp

It only reads the URL / domain request to pick where the end user
goes.

----------------------------------------------------------------------
ElevenNotes · 2023-10-24 07:51

Ah shit I missed the TCP and SNI part, but still, it’s for HTTP
endpoints, not pure TCP. SO you would be easier and better of using
Traefik TLS streams or Nginx streams with better and easier blocklists
for CIDR.

----------------------------------------------------------------------
BouncyPancake · 2023-10-24 08:10

'backend manage\_ssl' is for HTTP and for an API

I never could get Nginx streams to do SNI or else I would've so done
that instead.

----------------------------------------------------------------------
ElevenNotes · 2023-10-24 09:10

Traefik and Nginx both do SNI for TLS streams (no TLS termination),
but have better support for plugins especially IP blocklists.

----------------------------------------------------------------------
Dizzybro · 2023-10-24 12:11

In your frontend have  something like


acl is\_whitelisted src -f /etc/hapee-2.6/ipwhitelists/mywhitelist

mywhitelist would contain a cidr or list of cidrs

[xxx.xxx.xxx.xxx/32](https://xxx.xxx.xxx.xxx/32)

[xxx.xxx.xxx.xxx/32](https://xxx.xxx.xxx.xxx/32)

and then you'd have

use\_backend rproxy\_ssl if is\_whitelisted

----------------------------------------------------------------------
BouncyPancake · 2023-10-24 13:35

So I don't need to do an && statment or something ?

I can just do

use\_backend manage\_ssl if is\_whitelisted
use\_backend manage\_ssl if { req\_ssl\_sni -i management.example.com
}

​

or would i have to do something like

use\_backend manage\_ssl if { req\_ssl\_sni -i management.example.com
} && if is\_whitelisted

----------------------------------------------------------------------
Dizzybro · 2023-10-24 13:37

Personally i'd split the req\_ssl\_sni into an acl

acl is\_whitelisted src -f /etc/hapee-2.6/ipwhitelists/mywhitelist

acl is\_mgmt req\_ssl\_sni -i
[management.example.com](https://management.example.com)  *(check my
syntax here)*

use\_backend manage\_ss if is\_whitelisted is\_mgmt

​

\^ interpreted as logical AND

----------------------------------------------------------------------
BouncyPancake · 2023-10-24 14:05

Thank you very much. I appreciate the help. I ended up creating ACLs
for the other entries as well just to keep it consistent.

I also learned about this 'sudo haproxy -f /etc/haproxy/haproxy.cfg
-c'. This allows me to see the syntax. I wish I knew about this sooner
lol.

Thanks again!