Re: TCP Keepalives

2013-05-03 Thread James Bensley
On 3 May 2013 17:28, Lukas Tribus wrote: > Hi James! > > >> Are the docs refering to these timers? >> http://tldp.org/HOWTO/TCP-Keepalive-HOWTO/usingkeepalive.html > > Correct. Thanks Lukas, just wanted to check before I start trashing my test servers :) Cheers, James.

RE: TCP Keepalives

2013-05-03 Thread Lukas Tribus
Hi James! > Are the docs refering to these timers? > http://tldp.org/HOWTO/TCP-Keepalive-HOWTO/usingkeepalive.html Correct. Cheers, Lukas

TCP Keepalives

2013-05-03 Thread James Bensley
Hi All, When setting TCP keep alive options like tcpka, clitcpka and srvtcpka (https://code.google.com/p/haproxy-docs/wiki/tcpka) Where are these controlled in the host? Are the docs refering to these timers? http://tldp.org/HOWTO/TCP-Keepalive-HOWTO/usingkeepalive.html Many thanks, James.

Re: Transparent TCP LoadBalancing on FreeBSD

2013-05-03 Thread Willy Tarreau
Hi, On Thu, May 02, 2013 at 07:16:25PM +0200, PiBa-NL wrote: > Hi ZeN & Willy, > > To use transparent proxying on FreeBSD you currently need to compile > with "USE_LINUX_TPROXY=yes". > And make a few changes to the source code (else it wont compile). > As a "quick and dirty fix" you could (manua

Re: haproxy 1.4.23 bug on TCP content inspection rules ?

2013-05-03 Thread Willy Tarreau
On Fri, May 03, 2013 at 10:01:50PM +0800, Jianhua Qin wrote: > Thanks for the quick reply. I fix it by using some iptables rules > just as you said. > Can it be avoided naturely? No, because "transparent" is really meant to be used that way. And haproxy has no way of knowing that the destination a

Re: haproxy 1.4.23 bug on TCP content inspection rules ?

2013-05-03 Thread Jianhua Qin
Thanks for the quick reply. I fix it by using some iptables rules just as you said. Can it be avoided naturely? huaqiuyu 2013/5/3 Willy Tarreau > Hi, > > On Fri, May 03, 2013 at 05:45:45PM +0800, Jianhua Qin wrote: > > hi, all > > > > Go straight to the point > > 1. base information > > haprox

Re: Monitor always returns HTTP 200

2013-05-03 Thread James Bensley
On 3 May 2013 14:49, Lukas Tribus wrote: > Hi James, > >> I am packet capturing on a client (172.22.0.220, not in the monitor >> subnet), browsing to the monitor uri (GET /oowahboh6eibooca) you can >> see at 14:08:24 I get a response "200 OK". Then I refresh the page 2 >> seconds later at 14:08:26

RE: Monitor always returns HTTP 200

2013-05-03 Thread Lukas Tribus
Hi James, > I am packet capturing on a client (172.22.0.220, not in the monitor > subnet), browsing to the monitor uri (GET /oowahboh6eibooca) you can > see at 14:08:24 I get a response "200 OK". Then I refresh the page 2 > seconds later at 14:08:26.215969 and at 14:08:26.217989 I get a 404 > resp

Re: Set cookie with external service

2013-05-03 Thread Daniel Storjordet
Hi Willy. Thanks for the answer. Making the client have to do a redirect is a drawback as it will result in making the first request quite slower. The reason for this setup is because each portal can have multiple channels, each with its own domain and we need to maintain session and portal stat

Re: Monitor always returns HTTP 200

2013-05-03 Thread James Bensley
Hi Willy, Thanks for clearing that up; On 3 May 2013 12:28, Willy Tarreau wrote: > As explained in the doc, "monitor-net" unconditionally returns 200 to > all connections coming from the specified network. > > If your request comes from another network, then "monitor fail" will > apply to reques

Re: Set cookie with external service

2013-05-03 Thread Willy Tarreau
Hi Daniel, On Fri, May 03, 2013 at 01:57:35PM +0200, Daniel Storjordet wrote: > Hi guys. > > Is it possible to do load balancing based on a cookie, and if the cookie is > not set, make HAProxy connect to a external service that returns a cookie > value to HAProxy and make HAProxy assing this cook

Set cookie with external service

2013-05-03 Thread Daniel Storjordet
Hi guys. Is it possible to do load balancing based on a cookie, and if the cookie is not set, make HAProxy connect to a external service that returns a cookie value to HAProxy and make HAProxy assing this cookie before continue to the correct backend? Example first time user: 1. Client connects,

Re: Monitor always returns HTTP 200

2013-05-03 Thread Willy Tarreau
Hi James, On Thu, May 02, 2013 at 04:55:16PM +0100, James Bensley wrote: > Hi all, > > I have configured haproxy using the below configuration. No matter > what URL I browser to I always receive a HTTP 200 response to my > browser. If I comment out the ACL and three monitor lines from the > front

Re: haproxy 1.4.23 bug on TCP content inspection rules ?

2013-05-03 Thread Willy Tarreau
Hi, On Fri, May 03, 2013 at 05:45:45PM +0800, Jianhua Qin wrote: > hi, all > > Go straight to the point > 1. base information > haproxy version: 1.4.23 > ip: 192.168.1.1 > snippet of haproxy.cfg > > *..* > *frontendtcp_frontend > bind:3128 > mode

Re: Monitor always returns HTTP 200

2013-05-03 Thread James Bensley
Hi guys, Thanks for the responses, my replies are below! On 2 May 2013 17:48, Lukas Tribus wrote: >> I always receive a HTTP 200 response to my browser > > How do you know that? tcpdump > In what condition does this happen (when you have less than 2 > backends alive or even with 2 or more back

RE: haproxy crashes with ddos mitigation config

2013-05-03 Thread Lukas Tribus
Yes, please reproduce with latest snapshot, and provide the output of haproxy -vv. Also, setup haproxy so it can generate a core. Make sure you CC the list haproxy@formilux.org when responding. Thanks, Lukas > Date: Fri, 3 May 2013 11:14:14 +0200 > Subject: R

haproxy 1.4.23 bug on TCP content inspection rules ?

2013-05-03 Thread Jianhua Qin
hi, all Go straight to the point 1. base information haproxy version: 1.4.23 ip: 192.168.1.1 snippet of haproxy.cfg *..* *frontendtcp_frontend bind:3128 modetcp* ** *tcp-request inspect-delay 3s tcp-request content acce

RE: haproxy crashes with ddos mitigation config

2013-05-03 Thread Lukas Tribus
Hi Smana! > haproxy crashes with the following error :  >  > kernel: [334012.858141] haproxy[6914] general protection ip:46832d  > sp:7fffe5e219e8 error:0 in haproxy[40+89000]  Please share the output of "haproxy -vv". > This behavior appears only with ssl frontends. Upgrade to latest sn

Re: haproxy crashes with ddos mitigation config

2013-05-03 Thread Smain Kahlouch
Another information, This behavior appears only with ssl frontends. I'm trying with non ssl frontend 2013/5/3 Smain Kahlouch > More information > OS : debian 6 > version : 1.5-dev18 > > > 2013/5/3 Smain Kahlouch > >> Hello, >> >> I currently have some troubles enabling ddos as described there

Re: haproxy crashes with ddos mitigation config

2013-05-03 Thread Smain Kahlouch
More information OS : debian 6 version : 1.5-dev18 2013/5/3 Smain Kahlouch > Hello, > > I currently have some troubles enabling ddos as described there : > > http://blog.exceliance.fr/2012/02/27/use-a-load-balancer-as-a-first-row-of-defense-against-ddos/ > > When i enable the following lines :

haproxy crashes with ddos mitigation config

2013-05-03 Thread Smain Kahlouch
Hello, I currently have some troubles enabling ddos as described there : http://blog.exceliance.fr/2012/02/27/use-a-load-balancer-as-a-first-row-of-defense-against-ddos/ When i enable the following lines : stick-table type ip size 100k expire 30s store conn_cur # Shut the new connection as