我有一个不寻常的问题（正如每个人在这个网站上所做的那样）。我在端口80和443上监听HAProxy。我正在将SSL加密卸载到HAproxy并将所有流量传递到端口80上的Web服务器。在我的HAProxy服务器前面有一个防火墙，NAT规则指向我的内部侦听IP地址HAProxy的。我们在端口443上通过SSL获得了一条不寻常的503消息，用于随机IP源地址。其他随机IP地址在SSL上工作正常。我们的服务是一个API，大多数流量都会通过，但只有很小的一部分会获得503.
这是一个有效的HAProxy日志条目和一个不起作用的日志条目 工作：
localhost haproxy[5404]: XXX.XXX.XXX.XXX:54787 [15/Jun/2016:22:46:57.592] https_in_ssl~ http_www2/web1 32/0/0/232/264 200 747 - - ---- 5/4/0/1/0 0/0 "POST /webservices/ourService.asmx HTTP/1.1"
不工作：
localhost haproxy[5404]: XXX.XXX.XXX.XXX:55494 [15/Jun/2016:22:46:39.514] https_in_ssl~ https_in_ssl/<NOSRV> -1/-1/-1/-1/227 503 212 - - SC-- 3/2/0/0/0 0/0 "POST /webservices/ourService.asmx HTTP/1.0"
我注意到的一件事是前端和后端在不工作的日志条目中是相同的。
这是我的配置文件：
peers prodHAproxypeers
peer haproxylb1 10.0.0.145:1024
peer haproxylb2 10.0.0.146:1024
global
log 127.0.0.1 local0
# log /dev/log local0
# log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /var/lib/haproxy/stats
stats timeout 30s
tune.ssl.default-dh-param 2048
user haproxy
group haproxy
daemon
defaults
log global
mode http
option httplog
option dontlognull
option redispatch
option forwardfor
option http-server-close
maxconn 5000
timeout connect 5s
timeout client 5h
timeout server 5h
timeout queue 30s
timeout http-request 5s
timeout http-keep-alive 15s
listen stats *:1936
mode http
stats enable
stats hide-version
stats realm Haproxy\ Statistics
stats uri /haproxy_stats
stats auth admin:hardPassword
stats admin if TRUE
frontend http_in
bind *:80
###Add new acl and use_backend entry for each new site
###new backend sections will be needed as well
acl is_www1 hdr(host) -i www1.domainname.com
acl is_www2 hdr(host) -i www2.domainname.com
acl is_www3 hdr(host) -i www3.domainname.com
acl is_www4 hdr(host) -i www4.domainname.com
acl is_wildcardwww hdr_end(host) -i domainname.com
use_backend http_www1 if is_www1
use_backend http_www2 if is_www2
use_backend http_www3 if is_www3
use_backend http_www4 if is_www4
use_backend http_www5 if is_www5
option forwardfor
option http-server-close
frontend https_in_ssl
mode http
bind *:443 ssl crt /etc/ssl/private/ no-sslv3
reqadd X-Forwarded-Proto:\ https
use_backend http_www1 if { ssl_fc_sni www1.domainname.com }
use_backend http_www2 if { ssl_fc_sni www2.domainname.com }
acl is_ssl_www5 hdr_end(host) -i domainname.com
use_backend http_www5 if is_ssl_www5
backend http_www1
balance source
cookie SRV_ID prefix
stick-table type ip size 1m expire 6h peers prodHAproxypeers
stick on src
###This site does not use host header - only the page name is needed###
# option httpchk HEAD /Default.aspx
###Added host header so haproxy can route around NLB - use below for checking###
option httpchk HEAD /Default.aspx HTTP/1.1\r\nHost:\ www1.domainname.com
server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
server p-websvr03 10.0.0.115:80 cookie pweb3 weight 5 check
server p-websvr04 10.0.0.118:80 cookie pweb4 weight 5 check
backend http_www2
balance roundrobin
stick-table type ip size 1m expire 6h peers prodHAproxypeers
stick on src
###This site uses host headers so this type of check is required###
option httpchk HEAD /default.htm HTTP/1.1\r\nHost:\ www2.domainname.com
server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
server p-websvr03 10.0.0.113:80 cookie pweb3 weight 5 check
server p-websvr04 10.0.0.116:80 cookie pweb4 weight 5 check
backend http_www3
balance roundrobin
cookie SRV_ID prefix
stick-table type ip size 1m expire 6h peers prodHAproxypeers
stick on src
###This site does not use host header - only the page name is needed###
option httpchk HEAD /login.aspx HTTP/1.1\r\nHost:\ www3.domainname.com
server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
server p-websvr03 10.0.0.113:80 cookie pweb3 weight 5 check
server p-websvr04 10.0.0.116:80 cookie pweb4 weight 5 check
backend http_www4
balance roundrobin
cookie SRV_ID prefix
stick-table type ip size 1m expire 6h peers prodHAproxypeers
stick on src
###This site uses host header so this type of check is required###
option httpchk HEAD /default.aspx HTTP/1.1\r\nHost:\ www4.domainname.com
server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
server p-websvr03 10.0.0.113:80 cookie pweb3 weight 5 check
server p-websvr04 10.0.0.116:80 cookie pweb4 weight 5 check
backend http_www5
balance roundrobin
cookie SRV_ID prefix
stick-table type ip size 1m expire 6h peers prodHAproxypeers
stick on src
###This site uses host header so this type of check is required###
option httpchk HEAD /default.aspx HTTP/1.1\r\nHost:\ www5.domainname.com
server p-websvr01 10.0.0.10:80 cookie pweb1 weight 45 check
server p-websvr02 10.0.0.11:80 cookie pweb2 weight 45 check
server p-websvr03 10.0.0.115:80 cookie pweb3 weight 5 check
server p-websvr04 10.0.0.117:80 cookie pweb4 weight 5 check
答案 0 :(得分：1)
似乎https_in_ssl前端处理请求，但由于没有选择后端（http_www1，http_www2和http_www5），因此会出现503错误（ =在这种情况下没有选择后端）。这是因为主机名不是www1.domainname.com，www2.domainname.com或* .domainname.com。您可以按照here的说明尝试捕获Host HTTP标头，并查看实际值是什么，以及失败的原因。
不确定为什么选择使用ssl_fc_sni而不是hdr（host），这似乎是bad idea，也可能是问题的根本原因。
答案 1 :(得分：0)
我这边也遇到这个问题503 NOSRV
因为在 haproxy 上配置：
acl is_www1 hdr(host) -i www1.domainname.com
但是当您访问时：
www1.domainname.com:888
不匹配
www1.domainname.com
修复：
您使用端口配置您的 haproxy 域部分：
acl is_www1 hdr(host) -i www1.domainname.com:888