Haproxy: Restrict access to untrusted IPs only to sub url

JaneD

12/11/22, 2:30 AM

I would like to restrict access to my pastebin server (I'm using zerobin) so that untrusted IPs can only open secrets, but not create them.

(note that the url https://fakepastebin.com below is just an example for the sake of giving this question some context)

Trusted IPs: allow access to https://fakepastebin.com (main page where they can generate secrets) Non trusted IPs: allow access only to secrets (eg https://fakepastebin.com/?29c6692368e9edc9#G4j8Y2w). Basically anything after https://fakepastebin.com/?*

Something like :

acl trusted-ip src -f /etc/haproxy/whitelist.lst
acl unprotected-pages path_beg ^/..*$

How do I make it so that the unprotected pages can be accessed by all IPs? I've never tried to limit the main page before...only sub-pages so I'm unsure how to do this. Appreciate the feedbacks!

UPDATE: With these in place I can now prevent untrusted IPs from going to the top level url:

acl url_my_app hdr_dom(Host) -i fakepastebin.com
acl top_level_uri path_reg ^/$
acl app-query query -m reg ^(pasteid=)*[0-9a-zA-Z]{16}$
http-request deny if url_my_app top_level_uri !app-query !trusted_ips

However I noticed that if I browse to https://fakepastebin.com/foobahshshshhs it will redirect me to the top level uri and I can access it then, which is not what I want :( how can I get haproxy to deny untrusted IPs access to the top level uri https://fakepastebin.com ?

Thanks

123

0 + 2

regex

haproxy

Michael Hampton

12/15/22, 6:54 PM

I looked at `acl url_my_app hdr_dom(Host) -i fakepastebin_com`. Is that just a typo? This should be the expected contents of the Host request header.

JaneD

12/15/22, 10:06 PM

Opps sorry yeah typo, have edited the question

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Haproxy: Restrict access to untrusted IPs only to sub url

TH: Haproxy: จำกัดการเข้าถึง IP ที่ไม่น่าเชื่อถือไว้เฉพาะ URL ย่อยเท่านั้น

RO: Haproxy: restricționați accesul la IP-uri neîncrezătoare numai la adresa URL secundară

RU: Haproxy: ограничить доступ к ненадежным IP-адресам только суб-адресом

VI: Haproxy: Chỉ giới hạn quyền truy cập vào các IP không đáng tin cậy đối với url phụ

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.