Bug #9524
closedHAProxy-Backend blocks routed vlan traffic
0%
Description
Hi everybody,
we have a weird haproxy-backend problem. HAProxy-backends seems to block routet traffic between two connected vlans, on the configured port.
Following is our setup:
VLAN1: Range: 192.168.40.0/22
VLAN2: Range: 192.168.47.0/24
Client1: 192.168.47.20
Mailserver: 192.168.42.3
Client1 want to reach directly, without the haproxy, the mailserver on the ports 993 and 465.
The Haproxy have a frontend and backend on the ports 993 and 465.
My test is a telnet session from Client1 to the mailserver over the ports 993 and 465. Boths tests are running into a timeout.
A telnet test to the port 143 to the mailserver gets an answer. All other listening ports from the mailserver can be reached, without the haproxy ports.
To make a negative test, I created a haprox-backend for port 143 to 192.168.42.3. After applying this change, I can't get a connection to port 143. After deleting the backend, connections are again possible.
Hint: The backend wasn't even in use from an frontend.
The interesting thing is that only the return packets get stuck in the firewall. Package recordings show on the client1 connections to the mail server, on the firewall connections from client1 to the mail server (no reply packages from the mail server to the client1) and on the mail server packages from client1 to the mail server and packages from the mail server to the client1.
Files