How can I close haproxy frontend connections coming from unknown hosts?

Question

Now I am using nginx to close connections from unknown hosts and return 444 "no response"

How do I achieve the same with haproxy which is in front of nginx (saving the extra step between haproxy and nginx)

current nginx config:

server {
  # Close connection for unrecognized hosts (444 no response)
  listen 80 default_server;
  listen [::]:80 default_server;

  return 444;
}

score 1 · Accepted Answer · answered Aug 06 '19 at 02:22

This can be achieved using "silent-drop"

acl host_example req.hdr(host) -i example.com
http-request silent-drop if not host_example

score 0 · Answer 2 · answered Aug 05 '19 at 07:00

0

Ejez you can either accept connections coming from known ip's are block connections of particular ip's in frontend of haproxy.

ref code:

acl network_allowed src 20.30.40.50 20.30.40.40
use_backend allowed_backend if network_allowed

or

acl is-blocked-ip src 192.0.2.11 192.0.2.12 192.0.2.18
http-request deny if is-blocked-ip

ref:

answered Aug 05 '19 at 07:00

Rangeesh

Thx @rangeesh for the reply. however I did not want to send a "403 forbidden" response to the client (using "deny"), instead I wanted not to send anything and close the connection at haproxy side and keep it hanging client side, this way bots will be slowed down a lot. I found "silent-drop" which achieves this. ref: https://www.haproxy.com/blog/introduction-to-haproxy-acls/#using-acls-to-block-requests – Ejez Aug 05 '19 at 18:11

2 Answers2