pfSense / HAProxy - ACL value

Networking & Firewalls
1

Hello,

My pfsense ip address is 10.0.0.1, web admin configured to works on port 4444.

I have haproxy reverse proxy rule, to forward https:// pfsense.mydomain.com to the device.

I also can access the device by using 10.0.0.1:4444

I would like to create a haproxy rule, to forward https://10.0.0.1 to https://pfsense.mydomain.com

so:

I have backend 10.0.0.1 port 4444 name “back_mydevice”

I have frontend listen to 443, with this ACL:

name: “acl1”

Expression: “Host contains”

Value: 10.0.0.1

Action: Use Backend - back_mydevice where condition is acl1

This works fine

But, I want to replace the value in the acl1 from 10.0.0.1 to a variable value [the device ip address]

so the action will be like that:

if Host contains [my device ip] then use backend “back_mydevice”

can the value in the ACL refer to the device ip address?

2

I don’t think there is a way to do that, but also make sure you leave 444 open as I don’t recommend using HAProxy for the pfsense management interface exclusively because if HAProxy has an issue you won’t be able to get in to fix it.

3

Thank you

As I said, I can always access the device using https://10.0.0.1:4444

4

I think you’ll have problems with this kind of arrangement. My preference if you’re going to run a reverse proxy on the same machine as the firewall is to create a virtual IP on the interface that is used just for the reverse proxy. So leave pfSense at 10.0.0.1 and add a VIP to the same interface of 10.0.0.10 and bind HAProxy to that address.

Forward http/https traffic on the WAN interface to 10.0.0.10 and set your internal DNS to resolve your domains to that same address.

That gives an obvious separation so you can differentiate traffic and there’s no need to play games with ACLs to hit the firewall IP directly. (Even if the ACL did work, you’d have a weird dependency on HAProxy to get to your firewall, which could leave you stranded if HAProxy crashed.)