Hi All,<br><br>I&#39;ve been playing with this for a little while now and before the all in front of me and my head meet I was wondering if someone else could shed some light on this for me please.<br><br>First off let me give you a over view of the network setup:<br>
My Virtual Machine has two interfaces eth0 has two addresses <a href="http://192.168.82.9/18">192.168.82.9/18</a> and <a href="http://192.168.82.10/18">192.168.82.10/18</a>. 192.168.82.9 is going to be for the management of the server and 192.168.82.10 is what the website will respond too. eth1 has a network of its own <a href="http://10.0.0.0/24">10.0.0.0/24</a> and I have two Debian Apache web servers that are connected to this network 10.0.0.10 and 10.0.0.20.<br>
If this was a real world setup I might have put the management address (192.168.82.9) on a different port but I didn&#39;t think of that at the time of setting this up but I may do that later.<br><br>Second what have I done!<br>
Well this is a brand new install of Centos6.2 minimal fully patched and both HAProxy and STunnel downloaded and installed. I&#39;m using the devel version of HAProxy but thats a different story and version 4.53 of STunnel.<br>
<br>Now the problem.<br>Both seem to work perfectly as-long as I don&#39;t want to know who is accessing my site which make it next to useless. However, I can get HAProxy to report the IP Address of the visitor as long as you visit the HTTP page on port 80 as per my configuration file. I can also get STunnel to work with HAProxy but as soon as I enable &#39;protocol = proxy&#39; the HTTPS side breaks and all I get in my browser is &#39;400 Bad Request Your browser sent an invalid request&#39;. I&#39;ve played with everything I can thing of and I still cant get a Transparent STunnel&gt;HAProxy solution working correctly.<br>
<br>Config Files:<br><br>stunnel.conf<br>======================================<br>chroot = /usr/local/var/lib/stunnel/<br>#setuid = nobody<br>setgid = nobody<br>pid = /stunnel.pid<br>cert = /usr/local/etc/stunnel/stunnel.pem<br>
key = /usr/local/etc/stunnel/stunnel.pem<br>options = NO_SSLv2<br>debug = 7<br>#fips = no<br>[https]<br>accept = <a href="http://192.168.82.10:443">192.168.82.10:443</a><br>connect = <a href="http://192.168.82.10:80">192.168.82.10:80</a><br>
protocol = proxy<br><br>haproxy.cfg<br>======================================<br>global<br>        daemon<br>        log /dev/log local4<br>        maxconn 40000<br>        ulimit-n 81000<br>defaults<br>        log global<br>
        mode    http<br>        contimeout      4000<br>        clitimeout      42000<br>        srvtimeout      43000<br><br>listen http1<br>        bind <a href="http://192.168.82.10:80">192.168.82.10:80</a><br>        mode http<br>
        option http-server-close<br>        option  forwardfor<br>        source 0.0.0.0 usesrc clientip<br>        balance roundrobin<br>        server http1_1 <a href="http://10.0.0.10:80">10.0.0.10:80</a> cookie http1_1 check  inter 2000 rise 2 fall 3<br>
        server http1_1 <a href="http://10.0.0.20:80">10.0.0.20:80</a> cookie http1_1 check  inter 2000 rise 2 fall 3<br><br><br>Log file<br>======================================<br>Apr  5 12:37:32 lbmaster haproxy[1351]: Proxy http1 started.<br>
Apr  5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: stunnel 4.53 on x86_64-unknown-linux-gnu platform<br>Apr  5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010<br>
Apr  5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6<br>Apr  5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf<br>
Apr  5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: FIPS mode is enabled<br>Apr  5 12:37:33 lbmaster stunnel: LOG6[1353:140163149080512]: Initializing service section [https]<br>Apr  5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Configuration successful<br>
Apr  5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Service [https] accepted connection from <a href="http://192.168.64.10:53149">192.168.64.10:53149</a><br>Apr  5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: connect_blocking: connecting <a href="http://192.168.82.10:80">192.168.82.10:80</a><br>
Apr  5 12:37:41 lbmaster haproxy[1352]: Connect from <a href="http://192.168.82.10:47570">192.168.82.10:47570</a> to <a href="http://192.168.82.10:80">192.168.82.10:80</a> (http1/HTTP)<br>Apr  5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: connect_blocking: connected <a href="http://192.168.82.10:80">192.168.82.10:80</a><br>
Apr  5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Service [https] connected remote server from <a href="http://192.168.82.10:47570">192.168.82.10:47570</a><br>Apr  5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Server-mode proxy protocol negotiations started<br>
Apr  5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Server-mode proxy protocol negotiations succeeded<br>Apr  5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: SSL accepted: new session negotiated<br>Apr  5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption)<br>
Apr  5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Compression: null, expansion: null<br>Apr  5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: SSL_shutdown successfully sent close_notify alert<br>Apr  5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Error detected on socket (read) file descriptor: Broken pipe (32)<br>
Apr  5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Connection reset: 187 byte(s) sent to SSL, 1 byte(s) sent to socket<br><br><br>Any help would be most gracefully received and welcome.<br><br><br>~Yours,<br>Scott<br>
 <br>