HTTP jump HTTPS for app gateway or WAF via Haproxy on Azure

Source: Internet
Author: User
Tags http redirect haproxy modsecurity

App Gateway on Azure is a seven-tier load balancing service, and WAF is an extension of App Gateway services. The seven-tier load balancer adds the functionality of the WAF to protect the HTTP service in the background.

Azure WAF is based on the WAF functionality implemented by the open source modsecurity owasp core rule sets. Please refer to Modsecurity's website for details: https://modsecurity.org/

The current version of Azure support for owasp CRS has 3.0 and 2.2.92 versions. You can also enable or disable a feature in the library, depending on your needs:

This article describes a feature that is not currently supported by app Gateway and WAF: HTTP jumps to HTTPS with Haproxy implementation.

First, the topological structure

The specific structure is as follows:

1. The user initiates an HTTP request,

2. APP Gateway forwards the 80 port of Haproxy to the backend based on the backend server situation,

3. Haproxy HTTP request, do HTTP redirect, to the app gateway HTTPS

4. User initiated HTTPS request

5. The APP gateway is SSL-offload, and if a WAF is configured, HTTP content will be detected to prevent various attacks

6. The APP gateway forwards 8080 ports to haproxy,haproxy and forwards 8080 requests to the Nginx 800 port, based on the backend server situation.

Second, the APP gateway configuration

The specific creation process no longer describes the two definitions of rule that describe HTTP and https:

1. Listener

Configuring HTTP and HTTPS two x Listner

2. Rules

Rules for http:

HTTPSD Rules:

3. HTTP setting

To add HTTPS settings:

The rest is OK with the default configuration.

Third, the configuration of Haproxy

Install Haproxy in the VM and add the following configuration:

#---------------------------------------------------------------------# main FrontendwhichProxys to the backends#---------------------------------------------------------------------Frontend main*: themode httpredirect location https://x.x.x.xFrontend main *:8080mode httpdefault_backend static#---------------------------------------------------------------------# static Backend forserving up images, stylesheets and such#---------------------------------------------------------------------backend staticbalance roundrobinserver static127.0.0.1: -Check

As you can see, the Haproxy listens on 80 and 80,802 ports. A 80-port request will be forwarded directly to the app Gateway's https,8080 port and will be routed to the 800-port Nginx service.

Iv. Configuration of Nignx

Nginx only need to change the service port to 800.

V. Testing

Browser Enter the address of the app Gateway:

http://139.219.232.180/

will be forwarded to https:

HTTP jump HTTPS for app gateway or WAF via Haproxy on Azure

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.