This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Last revision Both sides next revision | ||
|
openbsd:net:relayd [2020/03/19 12:33] jrmu |
openbsd:net:relayd [2020/08/05 12:12] jrmu |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| Suppose you want to have relayd act as a reverse proxy for two different domains served on separate ports. In this case, suppose both www.ircnow.org and bnc.ircnow.org need relayd to provide TLS acceleration, but run on separate ports (1338 and 8080). | Suppose you want to have relayd act as a reverse proxy for two different domains served on separate ports. In this case, suppose both www.ircnow.org and bnc.ircnow.org need relayd to provide TLS acceleration, but run on separate ports (1338 and 8080). | ||
| + | ===== HOWTO ===== | ||
| + | You need to edit ''/etc/relayd.conf'' with the following contents. Alternatively, you can copy a sample config file from ''/etc/examples/relayd.conf'' and adjust it to your needs. | ||
| <code> | <code> | ||
| ext_addr="192.168.1.1" | ext_addr="192.168.1.1" | ||
| Line 43: | Line 45: | ||
| **WARNING**: Do not have httpd listen on port 443, or else the reverse proxy will fail to forward based on hostname for android and iOS devices! | **WARNING**: Do not have httpd listen on port 443, or else the reverse proxy will fail to forward based on hostname for android and iOS devices! | ||
| + | |||
| + | **WARNING**: Make sure that packet filter is enabled! relayd will not run if pf is disabled. | ||
| + | |||
| + | If your httpd is listening on port 443 with TLS, adjust it to another port and without tls. In the prior example where ''<www>'' is to be redirected to port 8080, you should have it set to something like ''listen on 192.168.1.1 port 8080'' instead, in your ''/etc/httpd.conf''. | ||
| + | |||
| + | Make sure to also reload/restart your httpd once you made adjustments. You can alternatively check to ensure your config file does not contain error prior to reloading/restarting. To do that, you can do, | ||
| + | <code> | ||
| + | # httpd -nf /etc/httpd.conf | ||
| + | </code> | ||
| + | |||
| + | ===== Troubleshooting ===== | ||
| + | |||
| + | ==== relayd fails to start ==== | ||
| + | If for whatever reason you fail to start relayd, you can troubleshoot it via making it perform a config test: | ||
| + | <code> | ||
| + | # relayd -n | ||
| + | </code> | ||
| + | If it does not show ''configuration OK'', it will typically indicate which line(s) containing error(s). | ||
| + | |||
| + | ==== relayd doesn't show verbose information ==== | ||
| + | According to [[https://man.openbsd.org/relayd.conf.5|man 5 relayd.conf]], you can add in the following close towards the top of your ''/etc/relayd.conf'', | ||
| + | <code> | ||
| + | log connection | ||
| + | </code> | ||
| + | Then reload/restart your relayd. | ||
| + | |||
| + | **WARNING**: This may produce a verbose output which can dramatically increase the size of your ''/var/log/daemon'', especially on busy networks. To avoid this, simply have your ''syslogd'' send all relayd messages into its own file. To that, see [[http://openbsd-archive.7691.n7.nabble.com/relayd-log-file-td76656.html|here]]. | ||
| + | |||
| + | In addition to splitting relayd logs to its own file, you may wish to create a new entry in your ''/etc/newsyslog.conf'' to handle log rotation for your relayd. | ||
| + | |||
| + | |||