HTTP jump HTTPS for app gateway or WAF via Haproxy on Azure

App Gateway on Azure is a seven-tier load balancing service, and WAF is an extension of App Gateway services. The seven-tier load balancer adds the functionality of the WAF to protect the HTTP service in the background.

Azure WAF is based on the WAF functionality implemented by the open source modsecurity owasp core rule sets. Please refer to Modsecurity's website for details: https://modsecurity.org/

The current version of Azure support for owasp CRS has 3.0 and 2.2.92 versions. You can also enable or disable a feature in the library, depending on your needs:

This article describes a feature that is not currently supported by app Gateway and WAF: HTTP jumps to HTTPS with Haproxy implementation.

First, the topological structure

The specific structure is as follows:

1. The user initiates an HTTP request,

2. APP Gateway forwards the 80 port of Haproxy to the backend based on the backend server situation,

3. Haproxy HTTP request, do HTTP redirect, to the app gateway HTTPS

4. User initiated HTTPS request

5. The APP gateway is SSL-offload, and if a WAF is configured, HTTP content will be detected to prevent various attacks

6. The APP gateway forwards 8080 ports to haproxy,haproxy and forwards 8080 requests to the Nginx 800 port, based on the backend server situation.

Second, the APP gateway configuration

The specific creation process no longer describes the two definitions of rule that describe HTTP and https:

1. Listener

Configuring HTTP and HTTPS two x Listner

2. Rules

Rules for http:

HTTPSD Rules:

3. HTTP setting

To add HTTPS settings:

The rest is OK with the default configuration.

Third, the configuration of Haproxy

Install Haproxy in the VM and add the following configuration:

#---------------------------------------------------------------------# main FrontendwhichProxys to the backends#---------------------------------------------------------------------Frontend main*: themode httpredirect location https://x.x.x.xFrontend main *:8080mode httpdefault_backend static#---------------------------------------------------------------------# static Backend forserving up images, stylesheets and such#---------------------------------------------------------------------backend staticbalance roundrobinserver static127.0.0.1: -Check

As you can see, the Haproxy listens on 80 and 80,802 ports. A 80-port request will be forwarded directly to the app Gateway's https,8080 port and will be routed to the 800-port Nginx service.

Iv. Configuration of Nignx

Nginx only need to change the service port to 800.

V. Testing

Browser Enter the address of the app Gateway:

http://139.219.232.180/

will be forwarded to https:

HTTP jump HTTPS for app gateway or WAF via Haproxy on Azure