FYI - SuiteCRM behind HAProxy/PFSense

[benjamin.long]

I’m posting this here in case anyone else runs into the same issue. I’m using HAProxy on my PFSense firewall as a reverse proxy for the SuiteCRM instance. I do this mostly to centralize my SSL certs and renewals. I was having an issue where attaching a document to a record would seem to time out, and occasionally create a bunch of empty document records. This didn’t occur when connecting directly to SuiteCRM. I found the solution here: https://forum.pfsense.org/index.php?topic=71515.msg390686#msg390686

Here is a copy/paste in case that link breaks:

(This solution was confirmed by magnust on the haproxy mailinglist. I want to document it here for others that might find this post with the same issue)
Hi magnust,

To get ‘transparent’ traffic working it was needed to in the background also load and configure part of “ipfw”… (this is also done for captive portal…) This so HAProxy gets to see the tcp reply traffic, and prevent replies from being routed out the wan interface… This makes pf break the connection after a few packets as it doesn’t see/process all the traffic.

The solution is to configure a “floating rule” like this:
Action: Pass
Quick: YES
Interface: DMZ (the one pointing to your server…)
Direction: Out
Protocol: TCP
Source: ANY
Destination: Server-IP
Destination: Server-PORT
State Type: sloppy state

I’m currently in the process of automating the creation this rule. Needs a little more testing and together with some other new features i think it will be ready in a week or so it will be part of the package version “1.5-dev21 pkg v 0.7”.

Greets PiBa-NL

After I set up that floating rule, the issue went away.

[pgr]

Thanks for taking the time to share this here.