<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Hello,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">I tried the following configuration but it's still not working as expected. Client browser receive connection closed and the failing server does not seem to get blacklisted...</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Any idea ?</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Thanks</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"></p>
<div>map $ssl_preread_server_name $name {<br>
default local_https;<br>
"" mag_strip_proxy_protocol;<br>
maintenance.domain.com mag_strip_proxy_protocol;<br>
}<br>
<br>
<br>
upstream mag {<br>
server 10.0.0.32:443 max_conns=10 weight=100 max_fails=1 fail_timeout=300;<br>
<br>
server 10.0.0.33:443 max_conns=10 weight=50 max_fails=1 fail_timeout=300;<br>
<br>
server 10.0.0.26:443 max_conns=10 weight=10 max_fails=1 fail_timeout=300 backup;<br>
server 10.0.0.27:443 max_conns=10 weight=10 max_fails=1 fail_timeout=300 backup;<br>
}<br>
<br>
upstream mag_strip_proxy_protocol {<br>
server 127.0.0.1:8080;<br>
}<br>
<br>
upstream local_https {<br>
server 127.0.0.1:8443;<br>
}<br>
<br>
<br>
log_format stream_routing '$remote_addr [$time_local] '<br>
'with SNI name "$ssl_preread_server_name" '<br>
'proxying to "$name" '<br>
'$protocol $status $bytes_sent $bytes_received '<br>
'$session_time';<br>
<br>
log_format upstream_routing '$proxy_protocol_addr [$time_local] '<br>
'proxying to "mag":$upstream_addr '<br>
'$protocol $status $bytes_sent $bytes_received '<br>
'$session_time';<br>
<br>
<br>
server {<br>
listen 443;<br>
ssl_preread on;<br>
proxy_pass $name;<br>
proxy_protocol on;<br>
access_log /var/log/nginx/stream_443.log stream_routing;<br>
}<br>
<br>
server {<br>
listen 8080 proxy_protocol;<br>
proxy_pass mag;<br>
access_log /var/log/nginx/mag.log upstream_routing;<br>
}</div>
<br>
<p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>De :</b> nginx <nginx-bounces@nginx.org> de la part de Adam Cecile <adam.cecile@hitec.lu><br>
<b>Envoyé :</b> mercredi 10 janvier 2018 20:02:59<br>
<b>À :</b> nginx@nginx.org; Maxim Dounin<br>
<b>Objet :</b> Re: upstream (tcp stream mode) doesn't detect connecton failure</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">[This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at
<a href="http://aka.ms/LearnAboutSpoofing">http://aka.ms/LearnAboutSpoofing</a>]<br>
<br>
On 01/10/2018 07:58 PM, Maxim Dounin wrote:<br>
> Hello!<br>
><br>
> On Wed, Jan 10, 2018 at 07:18:36PM +0100, Adam Cecile wrote:<br>
><br>
> [...]<br>
><br>
>>> Ok, so you use multiple proxy layers to be able to combine<br>
>>> backends which support/need PROXY protocol and ones which do not,<br>
>>> right? This looks like a valid reason, as "proxy_protocol" is<br>
>>> either on or off in a particular server.<br>
>> Yes exactly !<br>
>><br>
>> Aim of this setup is to do SNI routing to TCP endpoints (with failover)<br>
>> or HTTPS virtual hosts.<br>
>>> If you want nginx to switch to a different backend while<br>
>>> maintaining two proxy layers, consider moving balancing to the<br>
>>> second layer instead. This way balancing will happen where<br>
>>> connection errors can be seen, and so nginx will be able to switch<br>
>>> to a different server on errors.<br>
>> Could you be more specific and show me how to do this with my current<br>
>> configuration ? I'm a bit lost...<br>
> At the first level, differentiate between hosts based on<br>
> $ssl_preread_server_name. Proxy to either "local_https" or to a<br>
> second-level server, say 8080. On the second level server, proxy<br>
> to an upstream group with servers you want to balance. Example<br>
> configuration (completely untested):<br>
><br>
> map $ssl_preread_server_name $name {<br>
> default local_https;<br>
> "" second;<br>
> pub.domain.com second;<br>
> }<br>
><br>
> upstream local_https {<br>
> server 127.0.0.1:8443;<br>
> }<br>
><br>
> upstream second {<br>
> server 127.0.0.1:8080;<br>
> }<br>
><br>
> upstream u {<br>
> server 10.0.0.1:443;<br>
> server 10.0.0.2:443;<br>
> }<br>
><br>
> server {<br>
> listen 443;<br>
> ssl_preread on;<br>
> proxy_pass $name;<br>
> proxy_protocol on;<br>
> }<br>
><br>
> server {<br>
> listen 127.0.0.1:8080 proxy_protocol;<br>
> proxy_pass u;<br>
> }<br>
><br>
> Logging and timeouts omitted for clarity.<br>
><br>
Very nice !<br>
<br>
I'll give a try tomorrow morning and let you know, thanks.<br>
<br>
_______________________________________________<br>
nginx mailing list<br>
nginx@nginx.org<br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a><br>
</div>
</span></font></div>
</body>
</html>