HAproxy reverse proxy not working from internet

HAproxy reverse proxy not working from internet

by Siniša Petković -
Number of replies: 9
Big Hi to everyone.


I Have been tasked of providing connection to our moodle users over internet, using HaProxy revers proxy.

This is my first run with Apache, Haproxy and moodle.


Moodle is in "/var/www/html/elearning" folder

Moodle v: 3.5.1

Haproxy:1.7


From our LAN:

- Moodle can be accessed directly from our LAN

- Moodle can be accessed over reverse proxy from our LAN


From internet:

Apache server (default page) is accessible through reverse proxy over internet

Moodle is not accessible throug reverse proxy over internet.


My haproxy config:


  frontend HAPFrontend

        mode http

        bind *:443 ssl crt /etc/ssl/certs/date_site.mycompany.hr.pem  crt /etc/ssl/certs/moodle.mycompany.hr.pem  ca-file /etc/ssl/certs/hr_sca.pem verify required


        mode http

        acl url_moodle hdr_beg(host) -i moodle

        acl url_date_site hdr_beg(host) -i date_site


        use_backend moodle if url_moodle

        use_backend date_site  if url_date_site


backend date_site

        mode http

        server erverts-01 sewp-hrdigits01.corp.mycompany.com:443  ssl crt /etc/ssl/certs/intermediate.pem  verify none

        mode http


backend moodle

        mode http

 

        server hrlp-moodle01.mycompany.net:443 ssl crt /etc/ssl/certs/intermediate.pem verify none


Average of ratings: -
In reply to Siniša Petković

Re: HAproxy reverse proxy not working from internet

by Matteo Scaramuccia -
Picture of Core developers Picture of Peer reviewers Picture of Plugin developers

Hi Siniša,

From our LAN:
- Moodle can be accessed directly from our LAN
- Moodle can be accessed over reverse proxy from our LAN

Regardless your HAProxy settings, you can't do what described above: Moodle requires an URI i.e. a unique base path so you need to route any user path to the reverse proxy, denying a direct access to the web server hosting Moodle - unless playing with DNS and two different addresses to route Moodle users based on their IP address.

That being said, you need to make few changes in the Moodle config.php file:

  1. $CFG->wwwroot should point to the "unique base path", including HTTPS
  2. you need to tell Moodle that it is running behind a reverse proxy by adding this line
  3. you need to tell Moodle that you're offloading SSL from the web server hosting Moodle to the reverse proxy in front of it

HTH,
Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: HAproxy reverse proxy not working from internet

by Siniša Petković -
I am sorry, think I was not clear enough.


I wanted to say that everything is working when I test from LAN, but proxy is not working over internet, If url rewrite is not possible I could live with that. I will just rename my backend.


Thank You

Average of ratings: -
In reply to Siniša Petković

Re: HAproxy reverse proxy not working from internet

by Matteo Scaramuccia -
Picture of Core developers Picture of Peer reviewers Picture of Plugin developers

Hi Siniša,

proxy is not working over internet

what is the exact error? A blank page? An HTTP status different from 200? A Moodle error page?

In your first post you've told us that "Apache server (default page) is accessible through reverse proxy over internet" so HAProxy looks like working and I've guessed that Moodle is telling you that the "URL is wrong".

Maybe I was not clear enough but it's not a matter of rewriting URLs, you cannot actually have a Moodle running fine if you play with different URLs:

  • internal users => http://<Internal FQDN>/moodle
  • external users => via HAProxy: https://<external FQDN>/moodle

you can configure just an URL with same protocol and FQDN for both internal and external users i.e. https://<FQDN (regardless being inside or outside your LAN>/moodle, otherwise Moodle will compliant about the wrong URL with errors like:

  • Incorrect access detected, this server may be accessed only through "https://<FQDN>/moodle" address, sorry. Please notify server administrator.
  • Reverse proxy enabled, server can not be accessed directly, sorry. Please contact server administrator.

HTH,
Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: HAproxy reverse proxy not working from internet

by Siniša Petković -

Matteo thank You for your time and good will to help me.


Proxy server is in DMZ zone. When I access it from lan using https://publicdns_name I land on Apache test page when I add https://publicdns_name/elearning I get moodle login page.


When I try to do the same over Internet for  https://pubicdns_name I get Apache test page, but when I go to https://publicdns_name/elearning I just get connection time out.

Average of ratings: -
In reply to Siniša Petković

Re: HAproxy reverse proxy not working from internet

by Matteo Scaramuccia -
Picture of Core developers Picture of Peer reviewers Picture of Plugin developers

Hi Siniša,

I just get connection time out

could you explore the "connection timeout"?
If you open the Developer Tools of your browser and open the Network pane, do you find any redirect i.e. HTTP Status 3xx to the "internal site" i.e. a subsequent connection timeout?

HTH,
Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: HAproxy reverse proxy not working from internet

by Siniša Petković -

Hi Matteo,

it would seem that problem is when I add /elearning to end of url, connection bypasses proxy and goes directly to backend.


So far i tried adding redirect rules to Apache or Haproxy, but then I get - to many redirects error.

 

Average of ratings: -
In reply to Siniša Petković

Re: HAproxy reverse proxy not working from internet

by Matteo Scaramuccia -
Picture of Core developers Picture of Peer reviewers Picture of Plugin developers

Hi Siniša,

connection bypasses proxy and goes directly to backend

What is the value of $CFG->wwwroot in the Moodle config.php file?
Guessing, it is exactly the value of the redirection: if yes, please re-read my previous post.

HTH,
Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: HAproxy reverse proxy not working from internet

by Siniša Petković -

Hi Matteo,

you were spot on.  changing  $CFG->wwwroot to public DNS name did the trick.

Reverse proxy is working OK now. accept few fonts that do not get loaded. I'm getting "not found" error. 

Thank you for your help!

Best regards,

Sinisa 

Average of ratings: -