Nginx uses the leaky bucket method to limit request rate. Nginx http_limit_req_module.
It means that if I set a limit to 100 req/sec, and then I get flooded by 120 req/sec, 100 requests will be served normally but 20 requests will be served by a 503 error.
How can I setup this with Haproxy?
I read a lot of the documentation about sc_http_req_rate but since the rate is always 120 req/sec. I am always returning 503 errors.
frontend main
bind *:80
acl foo_limited_req sc_http_req_rate(0) ge 100
http-request track-sc0 path table Abuse # Set the URI as the key of the table
use_backend bk1 if foo_limited_req
default_backend web
backend web
server web1 192.168.0.10
backend Abuse
stick-table type string len 128 size 100K expire 30m store http_req_rate(1s)
backend bk1
server listenerror 127.0.0.1:81
listen errorlistener
bind 127.0.0.1:81
mode http
errorfile 503 /etc/haproxy/errors/200-tuned.http
I want to serve the flow of 100 req/sec with web backend. And the 20 req/sec surplus with bk1 backend.
Youll want to set the maxconn setting in your global settings to "X", which is your desired rate limit.
See below for an example of mine:
global
log 127.0.0.1 syslog
maxconn 1000
user haproxy
group haproxy
daemon
Related
i want to make one website(lets say blocked.com) that is not accessible from my country to be accessible for my clients throue the custom url like notblocked.com using haproxy.
i have my haproxy box configured on the vps outside of the country. the main problem is,that website sending url redirection on the response body using javascript function and my clients getting redirected to the original web address.
how can i intersept the response body and change the domain name in the java scrip to my domain (notblocked.com) .
haproxy configuration
global
log 127.0.0.1 local0
maxconn 4000
maxsslconn 256
tune.ssl.default-dh-param 2048
daemon
uid 99
gid 99
defaults
log global
mode http
option httplog
option dontlognull
timeout server 5s
timeout connect 5s
timeout client 5s
stats enable
stats refresh 10s
stats uri /stats
frontend https_frontend
bind *:443 ssl crt /etc/ssl/certs/kstore.pem
no option http-server-close
mode http
default_backend web_server
http-request set-header Host blocked.com
backend web_server
mode http
balance roundrobin
server srv01 1.2.3.4:443 weight 1 maxconn 100 check ssl verify none
thanks
I have an Haproxy 1.5.4. I would like to configure the haproxy to use a different backend for each request. This way , I want to ensure that a diffeent backend is used for each request. I curently use the following config:
global
daemon
maxconn 500000
nbproc 2
log 127.0.0.1 local0 info
defaults
mode tcp
timeout connect 50000ms
timeout client 500000ms
timeout server 500000ms
timeout check 5s
timeout tunnel 50000ms
option redispatch
listen httptat *:3310
mode http
stats enable
stats refresh 5s
stats uri /httpstat
stats realm HTTPS proxy stats
stats auth https:xxxxxxxxxxx
listen HTTPS *:5008
mode tcp
#maxconn 50000
balance leastconn
server backend1 xxx.xxx.xxx.xxx:125 check
server backend1 xxx.xxx.xxx.xxx:126 check
server backend1 xxx.xxx.xxx.xxx:127 check
server backend1 xxx.xxx.xxx.xxx:128 check
server backend1 xxx.xxx.xxx.xxx:129 check
server backend1 xxx.xxx.xxx.xxx:130 check
......
simply change the balance setting from leastconn to roundrobin
from the haproxy manual for 1.5 :
roundrobin Each server is used in turns, according to their weights.
This is the smoothest and fairest algorithm when the server's
processing time remains equally distributed. This algorithm
is dynamic, which means that server weights may be adjusted
on the fly for slow starts for instance. It is limited by
design to 4095 active servers per backend. Note that in some
large farms, when a server becomes up after having been down
for a very short time, it may sometimes take a few hundreds
requests for it to be re-integrated into the farm and start
receiving traffic. This is normal, though very rare. It is
indicated here in case you would have the chance to observe
it, so that you don't worry.
https://cbonte.github.io/haproxy-dconv/1.5/configuration.html#4-balance
I've been trying, and failing so far, to run Transmission behind HAProxy.
If I just add a new backend and route traffic as follows:
frontend http-in
bind *:80
reqadd X-Forwarded-Proto:\ http
acl host1 hdr_end(host) -i web.host1.host
use_backend apache_backend if host1
acl transmission_host hdr_end(host) -i transmission.host1.host
use_backend transmission_backend if transmission_host
Then I get a 409 conflict error stating I have an invalid session-id header. That's pretty obvious and expected since there's a proxy in the middle.
I thought of recompiling transmission to get rid of the check, but decided in the end to face the challenge of learning a bit more of HAProxy. What did I have in mind?
Client reaches HAProxy
HAProxy connects to transmission-daemon
Daemon replies with X-Transmission-Session-Id
HAProxy stores the Session-Id somehow and replaces Session-Id sent by the client with the one captured by HAProxy.
After a lot of Googling and playing with the settings, I got an almost working configuration:
frontend http-in
bind *:80
reqadd X-Forwarded-Proto:\ http
capture response header X-Transmission-Session-Id len 48
acl host1 hdr_end(host) -i web.host1.host
use_backend apache_backend if host1
acl transmission_host hdr_end(host) -i transmission.host1.host
use_backend transmission_backend if transmission_host
backend transmission_backend
mode http
http-request set-header X-Transmission-Session-Id %hs
server transmission-daemon transmission.intranet:9091
My configuration examples are summarized.
It works, sort of. I get a login prompt for transmission, but the page loads incredibly slow. I'm more than 10 minutes in and still don't have it fully loaded.
More pages go through this proxy: HTTP, HTTPS, TCP, some load balanced, some set as fail-overs. They all load normally and fast. If I connect directly to the transmission-daemon server, it loads fast as well.
I'll keep looking around.
Any ideas?
Thanks in advance!
3 years later,
from what I've seen in https://gist.github.com/yuezhu/93184b8d8d9f7d0ada0a186cbcda9273
you should capture request and response in frontend http-in,
I didn't dug much more, but the backend seems to need
stick-table type binary len 48 size 30k expire 30m
stick store-response hdr(X-Transmission-Session-Id)
stick on hdr(X-Transmission-Session-Id)
to work
I have 3 different restful servers: w1, w2, w3
My clients that refer to my load balancer are providing the url parameter called "ip" (ipv4). The url parameter ip is different between a requests:
curl -XGET http://localhost:8080/api/v1/link?ip=x.x.x.x
I would like to balance with HAProxy to w1, w2, w3 according to the ip parameter using HASH algo.
HAProxy configuration below:
global
#daemon
maxconn 3000
defaults
mode http
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
frontend http-in
bind *:80
default_backend workers
backend workers
balance url_param ip
hash-type consistent
server w1 localhost:8080 weight 1 maxconn 1000 check
server w2 localhost:8081 weight 1 maxconn 1000 check
server w3 localhost:8082 weight 1 maxconn 1000 check
listen admin
bind *:8088
stats hide-version
stats realm HAProxy\ statistics
stats enable
How can I achieve that?
With HAProxy 1.6.4 (and lower versions) choose the source balance algorithm. I think this algorithm should do your job or was there a reason for choosing balance url_param ?
balance source
hash-type consistent
The hash-type is optional but could be useful. Here some further information.
My HAProxy box is sending a 301 and redirecting my http traffic directly to the configured backend. I do not have it configured to do so. Here is the config. Any ideas on what could possibly be wrong?
Thanks
Greg
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
tune.ssl.default-dh-param 2048
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
defaults
mode http
log global
retries 3
timeout connect 10s
timeout client 1m
timeout server 1m
maxconn 3000
frontend input_8081
bind 192.168.119.111:8081
default_backend out_8081
frontend input_8082
bind 192.168.119.111:8082 ssl crt /etc/haproxy/proxy_server.pem
default_backend out_8082
backend out_8081
server ad-video 192.168.115.1:8081
backend out_8082
server ad-video 192.168.115.1:8082
Greg,
Your server must be generating the 301.
Sharing the logs generated by HAProxy may confirm this.
Baptiste
Turns out the server I am trying to proxy requires a full URL from the proxy to it's index.html page or it returns a 301 error (Moved Permanently).
Thanks to everyone for giving this a look.
Greg