Howto16r1:Reverse Proxy with HAProxy

This article explains how to configure HAProxy to work with the innovaphone Reverse Proxy, specifically when using WebSockets.

Problem Description

When HAProxy is deployed in front of an innovaphone Reverse Proxy, WebSocket connections may not function correctly by default. This can cause issues such as:

• myApps browser sessions reloading or disconnecting periodically (e.g. every 60 seconds)
• WebSocket-based services failing to establish stable connections
• Unexpected behavior with real-time communication features

This happens because HAProxy requires specific configuration to handle WebSocket upgrades properly. The most common issue is that the WebSocket Upgrade/Connection headers are not passed through correctly, or the HTTP keep-alive behavior interferes with the persistent WebSocket connection.

Solution

HAProxy needs to be configured to pass through the WebSocket upgrade headers correctly. The following configuration changes are required:

• Enable HTTP keep-alive
• Pass through the Upgrade and Connection headers
• Configure proper timeouts for WebSocket connections

The key is to add the correct headers to the backend configuration so that HAProxy does not interfere with the WebSocket upgrade process.

Configuration Example

The following is a working HAProxy configuration example for connecting to an innovaphone Reverse Proxy:

frontend https-frontend
   bind *:443
   mode http
   option http-keep-alive
   timeout client 30000
   http-request set-var(txn.txnhost) hdr(host)
   use_backend innovaphone if { var(txn.txnhost) -m sub inovaphone }

backend innovaphone
   mode http
   timeout connect 30000
   timeout server 30000
   http-request set-header X-Forwarded-Proto https
   http-request set-header Host 192.168.26.11
   http-request set-header X-Forwarded-Host inovaphone.example.com
   http-request set-header Upgrade %[hdr(upgrade)]
   http-request set-header Connection %[hdr(connection),lower]
   server innovaphone 192.168.26.11:80 check

Key Parameters Explained

• option http-keep-alive (frontend): Ensures that the frontend connection is kept alive and can be reused for multiple requests, including WebSocket upgrades.
• timeout client/server 30000: Sufficiently long timeouts to prevent premature disconnection of persistent WebSocket connections.
• http-request set-header X-Forwarded-Proto https: Preserves the original protocol (HTTPS) so that the innovaphone Reverse Proxy can correctly identify the scheme.
• http-request set-header Host: Sets the correct Host header for the backend, which is important for virtual host routing on the innovaphone Reverse Proxy.
• http-request set-header Upgrade: Passes the Upgrade header (e.g. "websocket") to the backend, which is required for the WebSocket handshake.
• http-request set-header Connection: Passes the Connection header (e.g. "Upgrade") to the backend, which is required for the WebSocket handshake.

Troubleshooting

If you are experiencing issues with WebSocket connections through HAProxy:

• Review the HAProxy configuration for proper WebSocket handling (see parameters above)
• Check the HAProxy logs for any connection errors
• Ensure that timeout values are set appropriately for long-lived connections
• Verify that the Upgrade and Connection headers are being passed through correctly
• Test the WebSocket connection without HAProxy in the path to isolate the problem

For detailed HAProxy WebSocket configuration, please refer to the official HAProxy documentation:

HAProxy WebSocket Blog

When to Open a Support Ticket

If problems persist after reviewing and adjusting the HAProxy configuration, please open a support ticket with:

• A pcap capture from the innovaphone Reverse Proxy (reverse proxy / all IPv4 TCP/UDP traffic / all IPv4 TLS traffic / enable RPCAP)
• The relevant Client ID
• Your HAProxy configuration (if available)