HAProxy : Load Balancing on Layer4

HAProxy : Load Balancing on Layer4 2015/02/18

Configure HAProxy on Layer4 Mode. This example based on the environment like follows. | -------+----------------------------------------------- | +-------------------+--------------------+ |10.0.0.30 |10.0.0.31 |10.0.0.32 +-----+-----+ +-------+------+ +-------+------+ | Frontend | | Backend#1 | | Backend#2 | | HAProxy | | MariaDB | | MariaDB | +-----------+ +--------------+ +--------------+

[1]	Configure HAProxy.

[root@dlp ~]#  vi /etc/haproxy/haproxy.cfg global log 127.0.0.1 local2 info chroot /var/lib/haproxy pidfile /var/run/haproxy.pid maxconn 256 maxsslconn 256 user haproxy group haproxy daemon defaults       # set "mode tcp" for Layer4 mode tcp log global timeout connect 10s timeout client 30s timeout server 30s # define frontend and backend servers frontend mysql-in bind *:3306 default_backend backend_servers backend backend_servers balance roundrobin server db01 10.0.0.31:3306 check server db02 10.0.0.32:3306 check [root@dlp ~]#  systemctl restart haproxy

[2]	Make sure all works fine to access to the frontend server from a Client with SQL like follows.

[root@desktop ~]#  mysql -u keystone -p -h 10.0.0.30 keystone -e "select * from table01;"  Enter password: +------+-------------------+ | id | name | +------+-------------------+ | 1 | db01.server.world | +------+-------------------+ [root@desktop ~]#  mysql -u keystone -p -h 10.0.0.30 keystone -e "select * from table01;"  Enter password: +------+-------------------+ | id | name | +------+-------------------+ | 1 | db02.server.world | +------+-------------------+

HAProxy : Refer to the Statistics#2

HAProxy : Refer to the Statistics#2 2015/02/18

	Configure HAProxy to see HAProxy's Statistics with commands.
[1]	Install some packages.

[root@dlp ~]#  yum -y install socat

[2]	Configure HAProxy.

[root@dlp ~]#  vi /etc/haproxy/haproxy.cfg # add follows in the "global" section global       # binds UNIX sockets stats socket /var/lib/haproxy/stats [root@dlp ~]#  systemctl restart haproxy

[3]	Refer to the Statistics like follows.

# display current stats [root@dlp ~]#  echo "show info" | socat /var/lib/haproxy/stats stdio Name: HAProxy Version: 1.5.2 Release_date: 2014/07/12 Nbproc: 1 Process_num: 1 Pid: 1953 ... ... Idle_pct: 100 node: dlp.server.world description: # display stas with CSV [root@dlp ~]#  echo "show stat" | socat /var/lib/haproxy/stats stdio # pxname,svname,qcur,qmax,scur,smax,slim,stot,bin,bout,dreq,dresp,ereq,econ,eresp,..... http-in,FRONTEND,,,0,1,2000,1,0,187,0,0,1,,,,,OPEN,,,,,,,,,1,2,0,,,,0,0,0,1,,,,0,0,..... backend_servers,www01,0,0,0,0,,0,0,0,,0,,0,0,0,0,UP,1,1,0,0,0,67,0,,1,3,1,,0,,2,0,,..... backend_servers,www02,0,0,0,0,,0,0,0,,0,,0,0,0,0,UP,1,1,0,0,0,67,0,,1,3,2,,0,,2,0,,..... backend_servers,BACKEND,0,0,0,0,200,0,0,0,0,0,,0,0,0,0,UP,2,2,0,,0,67,0,,1,3,0,,0,,..... # display current session [root@dlp ~]#  echo "show sess" | socat /var/lib/haproxy/stats stdio 0x7fbc09349150: proto=tcpv4 src=10.0.0.18:55987 fe=http-in be=<NONE> srv=<none> ts=08 age=4s calls=8 rq[f=400000h,i=0,an=1ch,rx=26s,wx=,ax=] rp[f=048200h,i=0,an=00h,rx=,wx=,ax=] s0=[7,8h,fd=1,ex=] s1=[0,0h,fd=2,ex=] exp=26s 0x7fbc09351d80: proto=unix_stream src=unix:1 fe=GLOBAL be=<NONE> srv=<none> ts=0b age=0s calls=1 rq[f=c08200h,i=0,an=00h,rx=10s,wx=,ax=] rp[f=008002h,i=0,an=00h,rx=,wx=,ax=] s0=[7,8h,fd=3,ex=] s1=[7,8h,fd=-1,ex=] exp= # for other operations # enter the interactive mode [root@dlp ~]#  socat readline /var/lib/haproxy/stats  prompt # show help >  help Unknown command. Please enter one of the following commands only : clear counters : clear max statistics counters (add 'all' for all counters) clear table : remove an entry from a table help : this message prompt : toggle interactive mode with prompt quit : disconnect show info : report information about the running process show pools : report information about the memory pools usage show stat : report counters for each proxy and server show errors : report last request and response errors for each proxy show sess [id] : report the list of current sessions or dump this session show table [id]: report table usage stats or dump this table's contents get weight : report a server's current weight set weight : change a server's weight set server : change a server's state or weight set table [id] : update or create a table entry's data set timeout : change a timeout setting set maxconn : change a maxconn setting set rate-limit : change a rate limiting value disable : put a server or frontend in maintenance mode enable : re-enable a server or frontend which is in maintenance mode shutdown : kill a session or a frontend (eg:to release listening ports) show acl [id] : report avalaible acls or dump an acl's contents get acl : reports the patterns matching a sample for an ACL add acl : add acl entry del acl : delete acl entry clear acl <id> : clear the content of this acl show map [id] : report avalaible maps or dump a map's contents get map : reports the keys and values matching a sample for a map set map : modify map entry add map : add map entry del map : delete map entry clear map <id> : clear the content of this map set ssl <stmt> : set statement for ssl # exit from interactive mode >  quit

HAProxy : Refer to the Statistics#1

HAProxy : Refer to the Statistics#1 2015/02/18

	Configure HAProxy to see HAProxy's Statistics on the web.
[1]	Configure HAProxy.

[root@dlp ~]#  vi /etc/haproxy/haproxy.cfg # add follows in the "frontend" section frontend http-in bind *:80       # enable statistics reports stats enable       # auth info for statistics site stats auth admin:adminpassword       # hide version of HAProxy stats hide-version       # display HAProxy hostname stats show-node       # refresh time stats refresh 60s       # statistics reports' URI stats uri /haproxy?stats [root@dlp ~]#  systemctl restart haproxy

[2]	Access to the frontend server from a Client with HTTP/HTTPS, then authentication is required like follows, input the auth info you set in config.

[3]	Just accessed. It's possible to refer to statistics of HAProxy on here.

HAProxy : SSL Settings

HAProxy : SSL Settings 2015/02/18

Configure HAProxy with SSL. The connection between HAproxy and Clients are encrypted with SSL. ( HAproxy - backends are normal ) This example based on the environment like follows. | -------+----------------------------------------------- | +-------------------+--------------------+ |10.0.0.30 |10.0.0.31 |10.0.0.32 +-----+-----+ +-------+------+ +-------+------+ | Frontend | | Backend#1 | | Backend#2 | | HAProxy | | Web Server | | Web Server | +-----------+ +--------------+ +--------------+

[1]	Create SSL certificates.

[root@dlp ~]#  cd /etc/pki/tls/certs  [root@dlp certs]#  openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/pki/tls/certs/haproxy.pem -out /etc/pki/tls/certs/haproxy.pem -days 365  Generating a 2048 bit RSA private key ......++++++ .......++++++ writing new private key to '/etc/pki/tls/certs/haproxy.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: JP # country State or Province Name (full name) [Some-State]: Hiroshima     # state Locality Name (eg, city) []: Hiroshima # city Organization Name (eg, company) [Internet Widgits Pty Ltd]: GTS     # company Organizational Unit Name (eg, section) []: Server World     # department Common Name (eg, YOUR name) []: dlp.server.world     # server's FQDN Email Address []: root@server.world # admin email address [root@dlp certs]#  chmod 600 haproxy.pem

[2]	Configure HAProxy for SSL.

[root@dlp ~]#  vi /etc/haproxy/haproxy.cfg # add in the "global" section global       # max per-process number of SSL connections maxsslconn 256       # set 2048 bits for Diffie-Hellman key tune.ssl.default-dh-param 2048 # add follows in the "frontend" section frontend http-in bind *:80       # specify port and certs bind *:443 ssl crt /etc/pki/tls/certs/haproxy.pem [root@dlp ~]#  systemctl restart haproxy

[3]	Make sure all works fine to access to the frontend server from a Client with HTTPS like follows.

HAProxy : HTTP Load Balancing

HAProxy : HTTP Load Balancing 2015/02/18

Install HAProxy to configure Load Balancing Server. This example based on the environment like follows. | -------+----------------------------------------------- | +-------------------+--------------------+ |10.0.0.30 |10.0.0.31 |10.0.0.32 +-----+-----+ +-------+------+ +-------+------+ | Frontend | | Backend#1 | | Backend#2 | | HAProxy | | Web Server | | Web Server | +-----------+ +--------------+ +--------------+

	Configure Servers that HTTP connection to HAProxy Server is forwarded to backend Web Servers.
[1]	Install HAProxy.

[root@dlp ~]#  yum -y install haproxy

[2]	Configure HAProxy.

[root@dlp ~]#  mv /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.org  [root@dlp ~]#  vi /etc/haproxy/haproxy.cfg # create new global       # for logging section log 127.0.0.1 local2 info chroot /var/lib/haproxy pidfile /var/run/haproxy.pid       # max per-process number of connections maxconn 256       # process' user and group user haproxy group haproxy       # makes the process fork into background daemon defaults       # running mode mode http       # use global settings log global       # get HTTP request log option httplog       # timeout if backends do not reply timeout connect 10s       # timeout on client side timeout client 30s       # timeout on server side timeout server 30s # define frontend ( set any name for "http-in" section ) frontend http-in       # listen 80 bind *:80       # set default backend default_backend backend_servers       # send X-Forwarded-For header option forwardfor # define backend backend backend_servers       # balance with roundrobin balance roundrobin       # define backend servers server www01 10.0.0.31:80 check server www02 10.0.0.32:80 check [root@dlp ~]#  systemctl start haproxy  [root@dlp ~]#  systemctl enable haproxy

[3]	Configure Rsyslog to get logs for HAProxy.

[root@dlp ~]#  vi /etc/rsyslog.conf # line 15,16: uncomment, lne 17: add $ModLoad imudp $UDPServerRun 514 $AllowedSender UDP, 127.0.0.1 # line 54: change like follows *.info;mail.none;authpriv.none;cron.none ,local2.none    /var/log/messages local2.* /var/log/haproxy.log [root@dlp ~]#  systemctl restart rsyslog

[4]	Change httpd settings on Backends to logging X-Forwarded-For header.

[root@www ~]#  vi /etc/httpd/conf/httpd.conf # line 196: change like follows LogFormat " \"%{X-Forwarded-For}i\"  %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined [root@www ~]#  systemctl restart httpd

[5]	Make sure all works fine to access to the frontend server from a Client with HTTP like follows.