How To Guide For HAProxy and Let's Encrypt on pfSense: Detailed Steps for Setting Up Reverse Proxy

Connecting With Us
---------------------------------------------------

Lawrence Systems Shirts and Swag
---------------------------------------------------

AFFILIATES & REFERRAL LINKS
---------------------------------------------------
Amazon Affiliate Store

UniFi Affiliate Link

All Of Our Affiliates that help us out and can get you discounts!

Gear we use on Kit

Use OfferCode LTSERVICES to get 10% off your order at

Digital Ocean Offer Code

HostiFi UniFi Cloud Hosting Service

Protect you privacy with a VPN from Private Internet Access

Patreon

⏱️Time Stamps ⏱️
00:00 HAProxy on pfsense
02:50 How The HAProxy Reverse Proxy Works
06:46 pfsene packages and WebConfigurator settings
07:28 ACME Let's Encrypt Setup
10:40 Setting Up HAProxy General Settings
11:47 Creating HAProxy Backend
12:50 Creating HAProxy Frontend
14:45 DNS Settings & Host Override Setup

#pfsense #firewall #networking

[esra_erimez]

This channel is one of the most valuable sysadmin channels on YouTube. I refer back here routinely. Your presentation is clear and accurate.

[TheMongolPrime]

Thank you as always Tom! I previously missed the part about having to set the record to the router's IP. After fixing that (thank you for being so mindful about speaking on it) I got HAProxy working perfectly!

[herbrodenhaber]

Thanks Tom .. i already have it setup and working externally with my home automation system.. but never did get it working internally.. time to take a second look @ it and get it setup .. appreciate all your hard work

[omgkingdano]

Thank you again Tom!

I got this working for our internal network, and now have no more annoying SSL warnings when I am using our servers/services. So nice for those of us with OCD about this stuff

Next hurdle, getting this to resolve for remote workers over OpenVPN.

[attracdev]

Tom, let me just tell you how amazing your content is! Thank you for all your hard work and willingness to share your knowledge with us simple folk. :)

[andrewwilson]

Excellent tutorial. THANK YOU for making this process clear. I have been using certbot for securing my web-services for years, but I never figured out how to get haproxy to host my cert for making even lan-only services accessible with a letsencrypt cert. This made that painless and simple.

[mattrajotte]

I set up my HA proxy 2 years ago based on these videos, it's great to get a refresher since the system has needed very little maintenance not sure I remember how to set it up!

[bobalachabbs]

This was an amazing guide. For me it was important to disable the monitoring on the backend, otherwise it wouldn't work. But I got it working! Thanks so much!

[BlitzFingers]

Ok, so this worked. I'm pretty shocked this solution was on my pfsense the whole time. I wish I had known this before the invested time in learning Nginx. Thanks for the very clear guide!
I'm looking forward to content in 2024 plus information on the new DHCP server backend.
You're a hero bro!

[esra_erimez]

I do not think that the importance of this video can be overstated. I've done already, and I wish this video was available then.

[davidtoddhoward]

Okay, so this answered all the questions I had from other videos on HAproxy.. Thanks so much Tom

[Spfinator]

Thanks for dropping the updated video link on the old one.

[someusername]

thank you - this will work really well to deal with apple not accepting self signed certs for things like local jupyter notebooks.

[JonahAberle]

This timing is insane I just setup HAProxy from the old video yesterday

[geoffpedder]

This is great, thanks for going into the details on this, best video on the subject i've seen

[danieljackson]

This is one of the best videos I’ve seen this year. Short, snappy and very important. Even sat at home sick as a dog with COVID I was still engaged throughout. I would love to see a follow up video which adds a 2FA authentication layer to this setup too (mainly for the external access use case) using an app such as Authelia. Great work Tom.

[mbutch]

Was just watching your previous video on this topic. Glad its now updated! Thanks, Tom

[jonathan.sullivan]

Loved the last video and happy to see an updated one. Leaving a comment and Like' to help the algorithm put this in front of more eyeballs. Thanks as always Tom and team.

[callmebigpapa]

@11:41 For anyone doing this and getting an error starting haproxy "Errors found while starting haproxy" for me it was was that I was on an old version of PF 2.7.0 updating to 2.7.2 skipping 2.7.1 fixed it for me, it seemed to have to do with dynamic pages not config'd for HTTP status codes. Also when you try to upgrade PF if it fails they you might have to execute the shell command "certctl rehash' in Diagnostics/command prompt. Hope this helps someone! Also @11:29 the syslog port is implied so just the IP is needed.

[rjrodwell]

Great Video. You make the same assumption on this video as your last one. "Host Matches" only works if the frontend port is 443. If you use a different port such as 10443, then you need to use "Host Contains". I spent way too long debugging that one! Thank you for everything you publish.