HAproxy on PFsense (websocket working) Updated Dec24

Code:

**Summary of HAProxy Configuration for WebSocket Support on pfSense (Obfuscated Version)**



Below is a detailed breakdown of the HAProxy configuration to get WebSocket connections working for your specific services like Jellyfin and Emby. This setup includes ACLs, actions, advanced settings, backend timeout settings, and backend passthrough settings.



### ACL Configuration (Access Control Lists)



To support WebSocket upgrades for the domains used, create the following ACLs:



1. **ACL Name: hdr\_connection\_upgrade**



  - **Expression**: Custom ACL

  - **Value**: `hdr(Connection) -i upgrade`



2. **ACL Name: hdr\_upgrade\_websocket**



  - **Expression**: Custom ACL

  - **Value**: `hdr(Upgrade) -i websocket`



3. **ACL Name: service1** (e.g., **jf** for Jellyfin)



  - **Expression**: Host Matches

  - **Value**: `service1.yourdomain.com`



4. **ACL Name: service2** (e.g., **emby** for Emby)



  - **Expression**: Host Matches

  - **Value**: `service2.yourdomain.com`



### Actions Configuration



Specify the actions to route the requests based on ACLs and headers:



1. **Set WebSocket Headers** (Place these before backend routing actions)



  - **Action**: `http-request set-header`



    - **Name**: `Connection`

    - **Fmt**: `upgrade`

    - **Condition ACL Names**: `{ req.hdr(Upgrade) -i websocket }`



  - **Action**: `http-request set-header`



    - **Name**: `Upgrade`

    - **Fmt**: `%[req.hdr(Upgrade)]`

    - **Condition ACL Names**: `{ req.hdr(Upgrade) -i websocket }`



2. **Use Backend (Routing based on ACLs)**



  - **Backend: service1-backend** (e.g., **jellyfin-backend**)

    - **Condition ACL Names**: `hdr_connection_upgrade hdr_upgrade_websocket or service1`

  - **Backend: service2-backend** (e.g., **emby-backend**)

    - **Condition ACL Names**: `hdr_connection_upgrade hdr_upgrade_websocket or service2`



### Advanced Settings for Frontend



To support stable WebSocket connections, configure advanced settings as follows:



1. **Client Timeout**: Set a longer client timeout to prevent premature disconnections.



  - **Value**: `3600000` ms (1 hour)



2. **HTTP Close Option**: Set to `http-keep-alive (default)` to maintain persistent connections.



3. **Advanced Pass Thru** (Paste into the advanced pass-through field for the frontend):



  ```

http-request set-header X-Forwarded-Port %[dst_port]

http-request add-header X-Forwarded-Proto https if { ssl_fc }

http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains;preload

http-response set-header X-Frame-Options "SAMEORIGIN"

http-response set-header X-Content-Type-Options "nosniff"

http-response set-header Referrer-Policy no-referrer-when-downgrade

http-request set-header X-Real-IP %[src]

http-response set-header X-XSS-Protection "1; mode=block"

http-response set-header Feature-Policy "geolocation 'none'"

http-response set-header Permissions-Policy "geolocation=(), microphone=(), camera=()"

http-response set-header X-Download-Options "noopen"

http-request set-header Connection "upgrade" if { req.hdr(Upgrade) -i WebSocket }

http-request set-header Upgrade %[req.hdr(Upgrade)]

http-response set-header Connection "keep-alive"

http-response set-header Expect-CT "enforce, max-age=86400"

http-response del-header Server

http-response del-header X-Powered-By

option http-server-close

option forwardfor



  ```



### Backend Timeout and Retry Settings



Configure the backend with appropriate timeout values to handle long-running streams.



1. **Connection Timeout**: `60000` ms (1 minute)

2. **Server Timeout**: `3600000` ms (1 hour)

3. **Retries**: `5000` (Number of attempts to reconnect after failures)



### Backend Pass Through Settings



Paste the following configuration in the **Backend Pass Thru** box:



```

http-request set-header X-Forwarded-Port %[dst_port]

http-request add-header X-Forwarded-Proto https if { ssl_fc }

server service1 192.168.XXX.XXX:8096

http-response set-header Cache-Control "no-cache, no-store, must-revalidate"

http-response del-header Server

option http-server-close

option forwardfor

```

Code:

http-request set-header X-Forwarded-Port %[dst_port]

http-request add-header X-Forwarded-Proto https if { ssl_fc }

http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains;preload

http-response set-header X-Frame-Options "SAMEORIGIN"

http-response set-header X-Content-Type-Options "nosniff"

http-response set-header Referrer-Policy no-referrer-when-downgrade

http-request set-header X-Real-IP %[src]

http-response set-header X-XSS-Protection "1; mode=block"

http-response set-header Feature-Policy "geolocation 'none'"

http-response set-header Permissions-Policy "geolocation=(), microphone=(), camera=()"

http-response set-header X-Download-Options "noopen"

http-request set-header Connection "upgrade" if { req.hdr(Upgrade) -i WebSocket }

http-request set-header Upgrade %[req.hdr(Upgrade)]

http-response set-header Connection "keep-alive"

http-response set-header Expect-CT "enforce, max-age=86400"

http-response del-header Server

http-response del-header X-Powered-By

option http-server-close

option forwardfor