I forgot to mention im using HAproxy 1.5dev18.
Hello HAProxy developers/users,

I would like to be able to run HAProxy transparently on FreeBSD 8.3.
This would be both for my own usage and also to make it available to a larger public by including it in a 'haproxy-devel' package for pfSense.

However when trying to use it i get the error:
/[ALERT] 104/235847 (72477) : parsing [/var/etc/haproxy.cfg:34] : 'usesrc' not allowed here because support for TPROXY was not compiled in./

From what i read it seams it should be possible.
For example the Makefile contains the following:
/ifeq ($(TARGET),freebsd)//
////USE_TPROXY     = implicit/
Which seams like it is supposed to be 'supported'.

Ive also tried the USE_LINUX_TPROXY=yes compile flag, but this returns 2 undeclared variables *SOL_IP* and *SOL_IPV6*. Ive tried declaring them with substitute values like 'IP_BINDANY', or the value 6 which could stand for the TCP protocol type, or 0. , but though the source did then compile the end result still was that either an error was returned to the browser that no backend was available, together with the following debug error: *[ALERT] 104/235129 (17380) : Cannot bind to tproxy source address before connect() for backend pb3TEST_http. Aborting.** *Or i dont get a response at all and HAproxy seems to be waiting for 'something' to happen..

Could it be that something is not fully supported in HAProxy toghether with FreeBSD to allow transparent proxying? Or am i looking at the wrong side of the problem and would i need to compile the FreeBSD kernel with tproxy support.? Which I believe would be natively supported in version 8, but i might be wrong on that..


I i add after "/*setsockopt(fd, SOL_IP, IP_TRANSPARENT, &one, sizeof(one)*/" this line:
*/setsockopt(fd, SOL_IP, IP_FREEBIND, &one, sizeof(one));/*
It removes the error about 'Cannot bind to tproxy source address...' and packets do seam to be send to the proper destination. Except the connection never establishes..

The browser running on 192.168.1.50 contacts haproxy on its IP:port http://192.168.1.22:81/ Haproxy then forwards the traffic to the server 192.168.0.40.81 which is according to status page "L7OK/200 in 0ms".

Also the reply packets gets routed back to the original client pc (wireshark confirmed that..), and seam not to get intercepted by HAproxy which i think is supposed to happen.?.. when passing through the 'FreeBSD router'.

But when performing a tcpdump on the interface in the 192.168.0.117 network only SYN and SYN-ack packets seem to be 'exchanged'.. Bet never any actual 'data' 21:02:04.915310 IP 192.168.1.50.51194 > 192.168.0.40.81: Flags [S], seq 352103919, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 1556876 ecr 0], length 0 21:02:04.915464 IP 192.168.0.40.81 > 192.168.1.50.51194: Flags [S.], seq 4102632929, ack 352103920, win 8192, options [mss 1260,nop,wscale 8,sackOK,TS val 1281557 ecr 1556876], length 0 21:02:04.915546 IP 192.168.1.50.51194 > 192.168.0.40.81: Flags [S], seq 352103919, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 1556876 ecr 0], length 0 21:02:07.910690 IP 192.168.0.40.81 > 192.168.1.50.51194: Flags [S.], seq 4102632929, ack 352103920, win 8192, options [mss 1260,nop,wscale 8,sackOK,TS val 1281857 ecr 1556876], length 0 21:02:07.911073 IP 192.168.1.50.51194 > 192.168.0.40.81: Flags [S], seq 352103919, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 1557176 ecr 0], length 0 21:02:07.911079 IP 192.168.1.50.51194 > 192.168.0.40.81: Flags [S], seq 352103919, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 1557176 ecr 0], length 0 21:02:11.110673 IP 192.168.1.50.51194 > 192.168.0.40.81: Flags [S], seq 352103919, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 1557496 ecr 0], length 0 21:02:11.110685 IP 192.168.1.50.51194 > 192.168.0.40.81: Flags [S], seq 352103919, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 1557496 ecr 0], length 0 21:02:13.913959 IP 192.168.0.40.81 > 192.168.1.50.51194: Flags [S.], seq 4102632929, ack 352103920, win 8192, options [mss 1260,sackOK,TS val 1282457 ecr 1556876], length 0

While when the pc contacts the webserver directly it works 'normally'..
20:45:12.746359 IP 192.168.1.50.3588 > 192.168.0.40.81: Flags [S], seq 24635592, win 64240, options [mss 1460,nop,nop,sackOK], length 0 20:45:12.746473 IP 192.168.0.40.81 > 192.168.1.50.3588: Flags [S.], seq 3353931105, ack 24635593, win 8192, options [mss 1260,nop,nop,sackOK], length 0 20:45:12.746937 IP 192.168.1.50.3588 > 192.168.0.40.81: Flags [.], ack 1, win 64260, length 0 20:45:12.747071 IP 192.168.1.50.3588 > 192.168.0.40.81: Flags [P.], ack 1, win 64260, length 282 20:45:12.750878 IP 192.168.0.40.81 > 192.168.1.50.3588: Flags [.], ack 283, win 65520, length 1260 20:45:12.751005 IP 192.168.0.40.81 > 192.168.1.50.3588: Flags [P.], ack 283, win 65520, length 1142 20:45:12.751463 IP 192.168.1.50.3588 > 192.168.0.40.81: Flags [.], ack 2403, win 64260, length 0 20:45:12.800179 IP 192.168.1.50.3588 > 192.168.0.40.81: Flags [P.], ack 2403, win 64260, length 297 20:45:12.800753 IP 192.168.0.40.81 > 192.168.1.50.3588: Flags [.], ack 580, win 65223, length 1260 20:45:12.800871 IP 192.168.0.40.81 > 192.168.1.50.3588: Flags [P.], ack 580, win 65223, length 151 20:45:12.801488 IP 192.168.1.50.3588 > 192.168.0.40.81: Flags [.], ack 3814, win 64260, length 0

See below my configuration of HAproxy:/
//global//
//    maxconn            300//
//    log            /var/run/log    local6    debug//
//    stats socket /tmp/haproxy.socket level admin//
//    nbproc            1//
//    chroot            /var/empty//
//    daemon//
//frontend test_pb3//
//    bind            192.168.1.22:81 //
//    mode            http//
//    log            global//
//    option            dontlognull//
//    maxconn            444//
//    timeout client        30000//
//    default_backend        pb3TEST_http//
//backend pb3TEST_http//
//    mode            http//
//    timeout connect        30000//
//    timeout server        30000//
//    retries            3//
//    option            httpchk OPTIONS / //
//    source 192.168.0.117 usesrc clientip//
// server pb3_srv 192.168.0.40:81 check inter 10000 weight 1 //
/
Could someone give me advice on what might need to change, what to test or how i could proceed further with making it work ?

Thanks in advance,
PiBa-NL


Reply via email to