You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Phael Ramirez <pr...@richardswilcox.com.INVALID> on 2024/09/26 14:13:29 UTC
Cloudflare and HAPROXY / HAPROXY
accessing our on-premise Apache Guacamole from the outside through
Cloudlfare's proxy, on-prem HAPROXY and finally to Guac. we get the REAL IP
and that's what we're hoping for. the issue we're having is accessing it
on-premise.
what are we missing?
Re: Cloudflare and HAPROXY / HAPROXY
Posted by Phael Ramirez <pr...@richardswilcox.com.INVALID>.
Is there anything that we could try?
On Thu, Sep 26, 2024 at 10:29 AM Phael Ramirez <pr...@richardswilcox.com>
wrote:
> HAPROXY config:
> backend webserver7-backend
> balance leastconn
> mode http
> # option forwardfor
> acl network_allowed src -f /etc/haproxy/ip_whitelist.txt
> acl from_cf src -f /etc/haproxy/ip_whitelist.txt
> acl cf_ip_hdr req.hdr(CF-Connecting-IP) -m found
> #Set X-Forwareded-For and X-Real-IP headers
> http-request set-header X-Forwarded-For
> %[req.hdr(CF-Connecting-IP)] if from_cf cf_ip_hdr
> http-request set-header X-Forwarded-For %[src] if !from_cf
> cf_ip_hdr
> # http-request set-header X-Client-IP %[req.hdr(CF-Connecting-IP)] if
> from_cf cf_ip_hdr
> # http-request set-header X-Client-IP %[src] if !from_cf cf_ip_hdr
> http-request set-header X-Real-IP %[req.hdr(CF-Connecting-IP)] if
> from_cf cf_ip_hdr
> http-request set-header X-Real-IP %[src] if !from_cf cf_ip_hdr
> # http-request set-header X-Real-IP %[req.hdr(CF-Connecting-IP)] if {
> req.hdr(CF-Connecting-IP) -m found }
> # http-request set-header X-Real-IP %[src] if !{
> req.hdr(CF-Connecting-IP) -m found }
> acl restricted_page path_beg /
> # http-request deny if !{ src X.X.X.X/X }
> acl is_root path -i /
> acl is_domain hdr(host) -i GUAC_FQDN
> redirect code 301 location GUAC_URL if is_domain is_root
> # http-request set-header X-Client-IP %[src]
> redirect scheme https if !{ ssl_fc }
> http-request deny if restricted_page !network_allowed
> http-response set-header X-Frame-Options SAMEORIGIN
> # http-response set-header X-XSS-Protection: 1;mode=block
> # http-response set-header Content-Security-Policy:script-src 'self'
> http-response set-header X-Content-Type-Options nosniff
> http-response set-header Strict-Transport-Security
> max-age=31536000;includeSubDomains;preload
> http-response set-header Referrer-Policy no-referrer-when-downgrade
> server HOSTNAME HAPROXY_IP:8080 check
>
> TOMCAT SERVER.XML:
> <!-- Pass through remote IP address provided by the reverse proxy -->
> <Valve className="org.apache.catalina.valves.RemoteIpValve"
> internalProxies="HAPROXY_IP"
> remoteIpHeader="x-forwarded-for"
> remoteIpProxiesHeader="x-forwarded-by"
> protocolHeader="x-forwarded-proto" />
>
> GUACAMOLE.PROPERTIES:
> # Enable the use of forwarded headers
> # This ensures Guacamole trusts the X-Forwarded-For header
> # Set to true if you are behind a reverse proxy like HAProxy
> enable-x-forwarded-for=true
>
> HAPROXY LOG:
> [image: image.png]
>
> ACTIVE SESSIONS
> First line is off-prem and second line is on-prem.
> [image: image.png]
> As for Cloudflare, I may not answer this correctly but we don't have any
> custom Header Modification, only in DNS that we enabled Proxy.
>
> As you can see, we've tried some combinations of HAPROXY config, but it
> will give us a different outcome. it's either we get REAL IP correctly
> on-premise or REAL IP off-premise. never both with REAL IP.
>
>
> On Thu, Sep 26, 2024 at 9:41 AM Nick Couchman <vn...@apache.org> wrote:
>
>> On Thu, Sep 26, 2024 at 10:37 AM Phael Ramirez
>> <pr...@richardswilcox.com.invalid> wrote:
>>
>>> when accessing Guac on-prem, the remote host shows HAPROXY's IP instead
>>> of the remote host's real IP in the "History" and "Active Sessions".
>>> on-prem:
>>>
>>> remote host --> HAPROXY --> Guac.
>>>
>>> when accessing Guac from outside, the remote host shows its real IP in
>>> the "History" and "Active Sessions". off-prem:
>>>
>>> remote host --> Cloudflare proxy --> Firewall --> HAPROXY --> Guac.
>>>
>>>
>> Can you share how you have header pass-through configured for both
>> Cloudflare and HAProxy, and what you've done in Tomcat to allow those
>> through? Also, can you verify that HAProxy is seeing the "real IP" of your
>> internal clients, as well, before it gets to Guac?
>>
>> -Nick
>>
>>>
Re: Cloudflare and HAPROXY / HAPROXY
Posted by Phael Ramirez <pr...@richardswilcox.com.INVALID>.
HAPROXY config:
backend webserver7-backend
balance leastconn
mode http
# option forwardfor
acl network_allowed src -f /etc/haproxy/ip_whitelist.txt
acl from_cf src -f /etc/haproxy/ip_whitelist.txt
acl cf_ip_hdr req.hdr(CF-Connecting-IP) -m found
#Set X-Forwareded-For and X-Real-IP headers
http-request set-header X-Forwarded-For
%[req.hdr(CF-Connecting-IP)] if from_cf cf_ip_hdr
http-request set-header X-Forwarded-For %[src] if !from_cf cf_ip_hdr
# http-request set-header X-Client-IP %[req.hdr(CF-Connecting-IP)] if
from_cf cf_ip_hdr
# http-request set-header X-Client-IP %[src] if !from_cf cf_ip_hdr
http-request set-header X-Real-IP %[req.hdr(CF-Connecting-IP)] if
from_cf cf_ip_hdr
http-request set-header X-Real-IP %[src] if !from_cf cf_ip_hdr
# http-request set-header X-Real-IP %[req.hdr(CF-Connecting-IP)] if {
req.hdr(CF-Connecting-IP) -m found }
# http-request set-header X-Real-IP %[src] if !{
req.hdr(CF-Connecting-IP) -m found }
acl restricted_page path_beg /
# http-request deny if !{ src X.X.X.X/X }
acl is_root path -i /
acl is_domain hdr(host) -i GUAC_FQDN
redirect code 301 location GUAC_URL if is_domain is_root
# http-request set-header X-Client-IP %[src]
redirect scheme https if !{ ssl_fc }
http-request deny if restricted_page !network_allowed
http-response set-header X-Frame-Options SAMEORIGIN
# http-response set-header X-XSS-Protection: 1;mode=block
# http-response set-header Content-Security-Policy:script-src 'self'
http-response set-header X-Content-Type-Options nosniff
http-response set-header Strict-Transport-Security
max-age=31536000;includeSubDomains;preload
http-response set-header Referrer-Policy no-referrer-when-downgrade
server HOSTNAME HAPROXY_IP:8080 check
TOMCAT SERVER.XML:
<!-- Pass through remote IP address provided by the reverse proxy -->
<Valve className="org.apache.catalina.valves.RemoteIpValve"
internalProxies="HAPROXY_IP"
remoteIpHeader="x-forwarded-for"
remoteIpProxiesHeader="x-forwarded-by"
protocolHeader="x-forwarded-proto" />
GUACAMOLE.PROPERTIES:
# Enable the use of forwarded headers
# This ensures Guacamole trusts the X-Forwarded-For header
# Set to true if you are behind a reverse proxy like HAProxy
enable-x-forwarded-for=true
HAPROXY LOG:
[image: image.png]
ACTIVE SESSIONS
First line is off-prem and second line is on-prem.
[image: image.png]
As for Cloudflare, I may not answer this correctly but we don't have any
custom Header Modification, only in DNS that we enabled Proxy.
As you can see, we've tried some combinations of HAPROXY config, but it
will give us a different outcome. it's either we get REAL IP correctly
on-premise or REAL IP off-premise. never both with REAL IP.
On Thu, Sep 26, 2024 at 9:41 AM Nick Couchman <vn...@apache.org> wrote:
> On Thu, Sep 26, 2024 at 10:37 AM Phael Ramirez
> <pr...@richardswilcox.com.invalid> wrote:
>
>> when accessing Guac on-prem, the remote host shows HAPROXY's IP instead
>> of the remote host's real IP in the "History" and "Active Sessions".
>> on-prem:
>>
>> remote host --> HAPROXY --> Guac.
>>
>> when accessing Guac from outside, the remote host shows its real IP in
>> the "History" and "Active Sessions". off-prem:
>>
>> remote host --> Cloudflare proxy --> Firewall --> HAPROXY --> Guac.
>>
>>
> Can you share how you have header pass-through configured for both
> Cloudflare and HAProxy, and what you've done in Tomcat to allow those
> through? Also, can you verify that HAProxy is seeing the "real IP" of your
> internal clients, as well, before it gets to Guac?
>
> -Nick
>
>>
Re: Cloudflare and HAPROXY / HAPROXY
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Sep 26, 2024 at 10:37 AM Phael Ramirez
<pr...@richardswilcox.com.invalid> wrote:
> when accessing Guac on-prem, the remote host shows HAPROXY's IP instead of
> the remote host's real IP in the "History" and "Active Sessions". on-prem:
>
> remote host --> HAPROXY --> Guac.
>
> when accessing Guac from outside, the remote host shows its real IP in the
> "History" and "Active Sessions". off-prem:
>
> remote host --> Cloudflare proxy --> Firewall --> HAPROXY --> Guac.
>
>
Can you share how you have header pass-through configured for both
Cloudflare and HAProxy, and what you've done in Tomcat to allow those
through? Also, can you verify that HAProxy is seeing the "real IP" of your
internal clients, as well, before it gets to Guac?
-Nick
>
Re: Cloudflare and HAPROXY / HAPROXY
Posted by Phael Ramirez <pr...@richardswilcox.com.INVALID>.
when accessing Guac on-prem, the remote host shows HAPROXY's IP instead of
the remote host's real IP in the "History" and "Active Sessions". on-prem:
remote host --> HAPROXY --> Guac.
when accessing Guac from outside, the remote host shows its real IP in the
"History" and "Active Sessions". off-prem:
remote host --> Cloudflare proxy --> Firewall --> HAPROXY --> Guac.
sorry about the first post, i may have sent it without mentioning the
actual issue.
On Thu, Sep 26, 2024 at 9:23 AM Nick Couchman <vn...@apache.org> wrote:
> On Thu, Sep 26, 2024 at 10:14 AM Phael Ramirez
> <pr...@richardswilcox.com.invalid> wrote:
>
>> accessing our on-premise Apache Guacamole from the outside through
>> Cloudlfare's proxy, on-prem HAPROXY and finally to Guac. we get the REAL IP
>> and that's what we're hoping for. the issue we're having is accessing it
>> on-premise.
>>
>>
> You'll need to explain this a little further. What issue are you having?
>
> -Nick
>
>>
Re: Cloudflare and HAPROXY / HAPROXY
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Sep 26, 2024 at 10:14 AM Phael Ramirez
<pr...@richardswilcox.com.invalid> wrote:
> accessing our on-premise Apache Guacamole from the outside through
> Cloudlfare's proxy, on-prem HAPROXY and finally to Guac. we get the REAL IP
> and that's what we're hoping for. the issue we're having is accessing it
> on-premise.
>
>
You'll need to explain this a little further. What issue are you having?
-Nick
>