Technical architectural analysis, practical configuration manifests, and deployment instructions for HAProxy on OPNsense: SSL Offloading & Load.
OPNSense’s NAT provides very powerful L4 routing, but the HAProxy plugin may need to be utilized depending on the purpose specified in Features.
๐ก
When using HAProxy, you must be aware of the following restrictions.
- Port forwarding of the same rule should be removed.
- Manually allow the same firewall rule. (Check departure location restrictions, etc.)
Installation
Install Plugin
- Install
os-haproxy(Community Plugin)
Service Enable
- Settings โ Services
- Use HAProxy:
checkand apply
Features
7-layer (application layer)-based load balancing
| HAProxy Function | Limitations of OPNsense NAT |
| Request-based distribution | Not possible |
It analyzes Layer 7 information, including HTTP headers, URL paths, and cookies, and routes traffic to another server. (e.g. /api to server A, /images to server B)
|
NAT only sees and processes the IP and port of the packet, and cannot read or analyze the \*\*content of the HTTP request (layer 7 data)\*\*. |
Branch to domain condition
- Add condition
Rules and checks โ conditions
- Add rule
Required: Add backend pool (= NAT redirect)
- Mapping rules to public services
Required: Add public service (= destination)
TLS Termination (SSL Offloading)
| HAProxy Function | Limitations of OPNsense NAT |
| Encryption/decryption processing | Not possible |
| The encrypted traffic received from the client is decrypted and delivered to the backend server as plain text (HTTP), or re-encrypted and delivered. | NAT is not involved in the content (payload) of the traffic; it simply allows encrypted traffic to pass through. NAT cannot manage or decrypt certificates. |
Step1. VIP Management
- WireGuard to LAN with HAProxy (for TLS Termination)
$$
\text{Client} \xleftrightarrow{[L3]tunnel/snat} \text{VPN Interface (Original Src)} \xrightarrow{[L3]decrypt/forward} \text{VIP Interface (Original Dst)} \xleftrightarrow{[L4]socket} \text{HAProxy Plugin} \xrightarrow{[L4/L7]dnat} \text{LAN Interface (Redirection)}
$$
-
How to set up VIP
-
Afterwards, specify it as a listening address in Frontend (public service)
- Add public service (= destination)
-
Add/Change DNS
Step2. Configuration
Below: Service โ HAProxy โ Settings
- Add SSL to destination
80port -
Add a real server (= 1 of NAT redirection)
-
Add backend pool (= NAT redirect)
-
Add public service (= destination)
-
Add SSL to destination
443port -
Add a real server (= one of NAT redirection)
-
Add backend pool (= NAT redirect)
-
Add public service (= destination)
Sophisticated health checks and high availability (HA)
| HAProxy Function | Limitations of OPNsense NAT |
| Check application status | Very limited |
| It periodically sends HTTP requests to the backend server to check for normal responses (e.g. HTTP 200 OK), and automatically diverts traffic if a problem occurs. | NAT port forwarding can only check whether the server is \*\*โconnectableโ (port is open)\*\* and cannot determine whether applications within the server are operating normally. |
Persistence
| HAProxy Function | Limitations of OPNsense NAT |
| Session maintenance | Not possible |
| Provides the ability (e.g. cookie-based, source IP-based) to force all requests from a specific client to be sent only to the same backend server. | NAT does not consider the server load each time a connection comes in, and simply forwards it according to set rules. It cannot remember or maintain previous connection states. |
Load balancing algorithm
| HAProxy Function | Limitations of OPNsense NAT |
| Various distribution methods | Very limited |
| It supports a variety of advanced distributed algorithms, including Least Connections (to the server with the fewest connections), Source Hash (based on source IP), and Round Robin. | OPNsense’s default port forwarding is not a 1:N forwarding concept, and distributing traffic to multiple servers requires the use of complex and limited methods (e.g. DNS Round Robin). |
CLI on OPNSense
Force Restart
/usr/local/etc/rc.d/haproxy stop
/usr/local/etc/rc.d/haproxy startLog
# HAProxy ๋ก๊ทธ๋ฅผ ํ์ธํ๋ ํ์ค ๋ช
๋ น
grep 'haproxy' /var/log/system/latest.logVerbose
/usr/local/sbin/haproxy -f /usr/local/etc/haproxy.conf -d
Leave a Reply