Skip to content
Commits on Source (2)
  • nimrod's avatar
    Router: Block private services at the HAProxy level. · 0153391a
    nimrod authored 
    HAProxy is used to inspect the SNI and route to the correct backend
without needing the SSL certificates and keys. Because it opens a new
TCP connection, the source IP at the other side is always the router's
internal IP so we can't filter there based on the source IP.
    0153391a
  • nimrod's avatar
    Router: Route SSH through HAProxy. · 8cd30e16
    nimrod authored 
    Use the HTTPS port so I can break out from restricted networks.
    8cd30e16
Hide whitespace changes
Inline Side-by-side
Ansible/roles/router/files/haproxy.cfg
View file @ 8cd30e16
......@@ -27,6 +27,16 @@ frontend http
acl kodi hdr(host) -i kodi.shore.co.il
acl kodi hdr(host) -i library.shore.co.il
acl kodi hdr(host) -i transmission.shore.co.il
acl lam hdr(host) -i lam.shore.co.il
acl auth hdr(host) -i auth.shore.co.il
acl private_ip src 127.0.0.1/8
acl private_ip src 10.0.0.0/8
acl private_ip src 192.168.0.0/16
acl private_ip src 172.16.0.0/12
acl shore_ip src 62.219.131.121
acl shore_ip src 163.172.74.36
http-request deny if lam !private_ip
http-request deny if auth !shore_ip !private_ip
use_backend kodi_http if kodi
default_backend host01_http
......@@ -35,14 +45,32 @@ frontend https
mode tcp
option tcplog
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
acl kodi req_ssl_sni -i jellyfin.shore.co.il
acl kodi req_ssl_sni -i kodi.shore.co.il
acl kodi req_ssl_sni -i library.shore.co.il
acl kodi req_ssl_sni -i transmission.shore.co.il
acl lam req_ssl_sni -i lam.shore.co.il
acl auth req_ssl_sni -i auth.shore.co.il
acl private_ip src 127.0.0.1/8
acl private_ip src 10.0.0.0/8
acl private_ip src 192.168.0.0/16
acl private_ip src 172.16.0.0/12
acl private_ip src 62.219.131.121
acl shore_ip src 62.219.131.121
acl shore_ip src 163.172.74.36
acl ssh req.payload(0,7) -m str "SSH-2.0"
acl ssl req_ssl_hello_type 1
tcp-request content reject if lam !private_ip
tcp-request content reject if auth !shore_ip !private_ip
tcp-request content accept if ssh ssl
use_backend kodi_https if kodi
use_backend localhost_ssh if ssh
default_backend host01_https
backend localhost_ssh
mode tcp
server ns1 127.0.0.1:22 check
backend host01_http
mode http
option forwardfor
......