Commit 0153391a authored by nimrod's avatar nimrod
Browse files

Router: Block private services at the HAProxy level. 

HAProxy is used to inspect the SNI and route to the correct backend
without needing the SSL certificates and keys. Because it opens a new
TCP connection, the source IP at the other side is always the router's
internal IP so we can't filter there based on the source IP.
parent 9f94e731

Ansible/roles/router/files/haproxy.cfg

+22 −1
Original line number Diff line number Diff line
@@ -27,6 +27,16 @@ frontend http 
        acl kodi hdr(host) -i kodi.shore.co.il

        acl kodi hdr(host) -i library.shore.co.il

        acl kodi hdr(host) -i transmission.shore.co.il

        acl lam hdr(host) -i lam.shore.co.il

        acl auth hdr(host) -i auth.shore.co.il

        acl private_ip src 127.0.0.1/8

        acl private_ip src 10.0.0.0/8

        acl private_ip src 192.168.0.0/16

        acl private_ip src 172.16.0.0/12

        acl shore_ip src 62.219.131.121

        acl shore_ip src 163.172.74.36

        http-request deny if lam !private_ip

        http-request deny if auth !shore_ip !private_ip

        use_backend kodi_http if kodi

        default_backend host01_http
@@ -35,11 +45,22 @@ frontend https 
        mode tcp

        option tcplog

        tcp-request inspect-delay 5s

        tcp-request content accept if { req_ssl_hello_type 1 }

        acl kodi req_ssl_sni -i jellyfin.shore.co.il

        acl kodi req_ssl_sni -i kodi.shore.co.il

        acl kodi req_ssl_sni -i library.shore.co.il

        acl kodi req_ssl_sni -i transmission.shore.co.il

        acl lam req_ssl_sni -i lam.shore.co.il

        acl auth req_ssl_sni -i auth.shore.co.il

        acl private_ip src 127.0.0.1/8

        acl private_ip src 10.0.0.0/8

        acl private_ip src 192.168.0.0/16

        acl private_ip src 172.16.0.0/12

        acl private_ip src 62.219.131.121

        acl shore_ip src 62.219.131.121

        acl shore_ip src 163.172.74.36

        tcp-request content reject if lam !private_ip

        tcp-request content reject if auth !shore_ip !private_ip

        tcp-request content accept if { req_ssl_hello_type 1 }

        use_backend kodi_https if kodi

        default_backend host01_https