How to restrict access for a back-end just to the internal network












1














I have an HAProxy with more than twenty backends and I need to limit access to one specific backend, CP-API.MACKMIL.COM, to the following internal network subnets:



10.10.0.0/16

10.20.0.0/16

10.30.0.0/16

10.40.0.0/16


Currently, with the following query, this domain, CP-API.MACKMIL.COM, can be accessed from the outside world but I want to limit that.



curl -vvv -H'Host: cp-api.mackmil.com' https://api.mackmil.com/initializations


My Haproxy config is as follows,



frontend http-https

bind :80 accept-proxy

bind :443 accept-proxy ssl crt /etc/pki/tls/private/wildcard.mackmil.com.pem crt /etc/pki/tls/private/wildcard.mackmil.de.pem



acl host_cp  hdr(host) -i cp-api.mackmil.com

acl host_cp  hdr(host) -i cp-api.prod.mackmil.com





use_backend app_cp   if host_cp



backend app_cp

server swarm-worker_10.10.30.199 10.10.30.199:64042 check

server swarm-worker_10.10.40.114 10.10.40.114:64042 check

server swarm-worker_10.20.40.159 10.20.40.159:64042 check

server swarm-worker_10.20.30.190 10.20.30.190:64042 check

server swarm-worker_10.30.40.143 10.30.40.143:64042 check

server swarm-worker_10.30.40.161 10.30.40.161:64042 check

server swarm-worker_10.40.40.107 10.40.40.107:64042 check

server swarm-worker_10.40.40.107 10.40.40.107:64042 check


I am struggling on applying this restriction in HTTP/HTTPS mode for just this endpoint.
How can I apply this restriction for this backend?






backend haproxy restrict







share|improve this question





























    1














    I have an HAProxy with more than twenty backends and I need to limit access to one specific backend, CP-API.MACKMIL.COM, to the following internal network subnets:



    10.10.0.0/16
    
10.20.0.0/16
    
10.30.0.0/16
    
10.40.0.0/16


    Currently, with the following query, this domain, CP-API.MACKMIL.COM, can be accessed from the outside world but I want to limit that.



    curl -vvv -H'Host: cp-api.mackmil.com' https://api.mackmil.com/initializations


    My Haproxy config is as follows,



    frontend http-https
    
bind :80 accept-proxy
    
bind :443 accept-proxy ssl crt /etc/pki/tls/private/wildcard.mackmil.com.pem crt /etc/pki/tls/private/wildcard.mackmil.de.pem
    

    
acl host_cp  hdr(host) -i cp-api.mackmil.com
    
acl host_cp  hdr(host) -i cp-api.prod.mackmil.com
    

    

    
use_backend app_cp   if host_cp
    

    
backend app_cp
    
server swarm-worker_10.10.30.199 10.10.30.199:64042 check
    
server swarm-worker_10.10.40.114 10.10.40.114:64042 check
    
server swarm-worker_10.20.40.159 10.20.40.159:64042 check
    
server swarm-worker_10.20.30.190 10.20.30.190:64042 check
    
server swarm-worker_10.30.40.143 10.30.40.143:64042 check
    
server swarm-worker_10.30.40.161 10.30.40.161:64042 check
    
server swarm-worker_10.40.40.107 10.40.40.107:64042 check
    
server swarm-worker_10.40.40.107 10.40.40.107:64042 check


    I am struggling on applying this restriction in HTTP/HTTPS mode for just this endpoint.
    How can I apply this restriction for this backend?






    backend haproxy restrict







    share|improve this question



























      1












      1








      1


      0





      I have an HAProxy with more than twenty backends and I need to limit access to one specific backend, CP-API.MACKMIL.COM, to the following internal network subnets:



      10.10.0.0/16
      
10.20.0.0/16
      
10.30.0.0/16
      
10.40.0.0/16


      Currently, with the following query, this domain, CP-API.MACKMIL.COM, can be accessed from the outside world but I want to limit that.



      curl -vvv -H'Host: cp-api.mackmil.com' https://api.mackmil.com/initializations


      My Haproxy config is as follows,



      frontend http-https
      
bind :80 accept-proxy
      
bind :443 accept-proxy ssl crt /etc/pki/tls/private/wildcard.mackmil.com.pem crt /etc/pki/tls/private/wildcard.mackmil.de.pem
      

      
acl host_cp  hdr(host) -i cp-api.mackmil.com
      
acl host_cp  hdr(host) -i cp-api.prod.mackmil.com
      

      

      
use_backend app_cp   if host_cp
      

      
backend app_cp
      
server swarm-worker_10.10.30.199 10.10.30.199:64042 check
      
server swarm-worker_10.10.40.114 10.10.40.114:64042 check
      
server swarm-worker_10.20.40.159 10.20.40.159:64042 check
      
server swarm-worker_10.20.30.190 10.20.30.190:64042 check
      
server swarm-worker_10.30.40.143 10.30.40.143:64042 check
      
server swarm-worker_10.30.40.161 10.30.40.161:64042 check
      
server swarm-worker_10.40.40.107 10.40.40.107:64042 check
      
server swarm-worker_10.40.40.107 10.40.40.107:64042 check


      I am struggling on applying this restriction in HTTP/HTTPS mode for just this endpoint.
      How can I apply this restriction for this backend?






      backend haproxy restrict







      share|improve this question















      I have an HAProxy with more than twenty backends and I need to limit access to one specific backend, CP-API.MACKMIL.COM, to the following internal network subnets:



      10.10.0.0/16
      
10.20.0.0/16
      
10.30.0.0/16
      
10.40.0.0/16


      Currently, with the following query, this domain, CP-API.MACKMIL.COM, can be accessed from the outside world but I want to limit that.



      curl -vvv -H'Host: cp-api.mackmil.com' https://api.mackmil.com/initializations


      My Haproxy config is as follows,



      frontend http-https
      
bind :80 accept-proxy
      
bind :443 accept-proxy ssl crt /etc/pki/tls/private/wildcard.mackmil.com.pem crt /etc/pki/tls/private/wildcard.mackmil.de.pem
      

      
acl host_cp  hdr(host) -i cp-api.mackmil.com
      
acl host_cp  hdr(host) -i cp-api.prod.mackmil.com
      

      

      
use_backend app_cp   if host_cp
      

      
backend app_cp
      
server swarm-worker_10.10.30.199 10.10.30.199:64042 check
      
server swarm-worker_10.10.40.114 10.10.40.114:64042 check
      
server swarm-worker_10.20.40.159 10.20.40.159:64042 check
      
server swarm-worker_10.20.30.190 10.20.30.190:64042 check
      
server swarm-worker_10.30.40.143 10.30.40.143:64042 check
      
server swarm-worker_10.30.40.161 10.30.40.161:64042 check
      
server swarm-worker_10.40.40.107 10.40.40.107:64042 check
      
server swarm-worker_10.40.40.107 10.40.40.107:64042 check


      I am struggling on applying this restriction in HTTP/HTTPS mode for just this endpoint.
      How can I apply this restriction for this backend?






      backend haproxy restrict




      backend haproxy restrict






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Nov 15 '18 at 15:12

























      asked Nov 14 '18 at 11:41









      Hadi

      165




      165
























          1 Answer
          1






          active

          oldest

          votes


















          1














          It got fixed by putting this in that backend:



          acl internal_subnets src 10.10.0.0/16
          
acl internal_subnets src 10.20.0.0/16
          
acl internal_subnets src 10.30.0.0/16
          
acl internal_subnets src 10.40.0.0/16
          
http-request deny if ! internal_subnets





          share|improve this answer





















            Your Answer






            StackExchange.ifUsing("editor", function () {
            StackExchange.using("externalEditor", function () {
            StackExchange.using("snippets", function () {
            StackExchange.snippets.init();
            });
            });
            }, "code-snippets");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "1"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53299427%2fhow-to-restrict-access-for-a-back-end-just-to-the-internal-network%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            1














            It got fixed by putting this in that backend:



            acl internal_subnets src 10.10.0.0/16
            
acl internal_subnets src 10.20.0.0/16
            
acl internal_subnets src 10.30.0.0/16
            
acl internal_subnets src 10.40.0.0/16
            
http-request deny if ! internal_subnets





            share|improve this answer


























              1














              It got fixed by putting this in that backend:



              acl internal_subnets src 10.10.0.0/16
              
acl internal_subnets src 10.20.0.0/16
              
acl internal_subnets src 10.30.0.0/16
              
acl internal_subnets src 10.40.0.0/16
              
http-request deny if ! internal_subnets





              share|improve this answer
























                1












                1








                1






                It got fixed by putting this in that backend:



                acl internal_subnets src 10.10.0.0/16
                
acl internal_subnets src 10.20.0.0/16
                
acl internal_subnets src 10.30.0.0/16
                
acl internal_subnets src 10.40.0.0/16
                
http-request deny if ! internal_subnets





                share|improve this answer












                It got fixed by putting this in that backend:



                acl internal_subnets src 10.10.0.0/16
                
acl internal_subnets src 10.20.0.0/16
                
acl internal_subnets src 10.30.0.0/16
                
acl internal_subnets src 10.40.0.0/16
                
http-request deny if ! internal_subnets






                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Nov 15 '18 at 15:10









                Hadi

                165




                165






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Stack Overflow!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.





                    Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


                    Please pay close attention to the following guidance:


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53299427%2fhow-to-restrict-access-for-a-back-end-just-to-the-internal-network%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    -

                    Popular posts from this blog

                    Guess what letter conforming each word

                    Image
                    6 $begingroup$ This is an entry in the Fortnightly Topic Challenge #41: Short and Sweet. 1 letter only could be mean anything . With an additional letter in front , could be used as medicine component and something you definitely learn or at least heard once. Add another letter in front , you would possibly hear that many times . Add an additional letter in front , you would found an independent country . With an additional letter, in the end , you would found something related to apple . Add another letter in the end , you would found something bad . Hint: Each letter is unique . word knowledge letters chemistry share | improve this question ...
                    Read more

                    Port of Spain

                    Image
                    For ports in the country of Spain, see List of ports in Spain. City in City of Port of Spain, Trinidad and Tobago Port of Spain City City of Port of Spain Top to bottom (left to right): Skyline of Port of Spain from Gulf of Paria; National Academy for the Performing Arts, Independence Square, Eric Williams Plaza; MovieTowne, Port of Port of Spain Motto(s):  "We Gather Strength As We Go Along" Port of Spain Coordinates: 10°40′N 61°31′W  /  10.667°N 61.517°W  / 10.667; -61.517 Coordinates: 10°40′N 61°31′W  /  10.667°N 61.517°W  / 10.667; -61.517 Country   Trinidad and Tobago Jurisdiction City of Port of Spain Settled 1560 Incorporated (town) 1853 Incorporated (city) 1914 Government  • Mayor Joel Martinez  • Governing body City Corporation Area [1]  • City 12 km 2 (5 sq mi) Elevation [2] 66 m (217 ft) Population (2011) [1]  • City 37,074  • Rank 3rd  • Density 3,090/km 2 (8,000/sq mi)...
                    Read more

                    Run scheduled task as local user group (not BUILTIN)

                    Image
                    0 I am trying to run a scheduled task with User Group (not a single user). This is working fine when I in the field "when running a task, use the following user account:" insert BUILTIN User Group (for example: Administrators or Users). But when I try it with the created Local User Group (example: TestGroup) it is not working. The Users in the TestGroup are the same as in the Administrators group. What could be the problem? Are there some restrictions to the Created User Group compared to BUILTINUsers? scheduled-tasks taskscheduler windowstaskschedule share | improve this question asked Nov 15 '18 at 15:36 Far...
                    Read more