summaryrefslogtreecommitdiff
path: root/etc/hoststated.conf
blob: 995d924ebfb371df93bb3674bec2222a46e6ae3e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# $OpenBSD: hoststated.conf,v 1.7 2007/10/22 08:44:54 reyk Exp $
#
# Macros
#
ext_addr="192.168.1.1"
webhost1="10.0.0.1"
webhost2="10.0.0.2"
sshhost1="10.0.0.3"

#
# Global Options
#
# interval 10
# timeout 200
# prefork 5

#
# Each table will be mapped to a pf table.
#
table webhosts {
	real port http
	check http "/" code 200
	host $webhost1
	host $webhost2
}

table fallback {
	real port http
	check icmp
	host 127.0.0.1
}

#
# Services will be mapped to a rdr rule.
#
service www {
	virtual host $ext_addr port http interface trunk0

	# tag every packet that goes thru the rdr rule with HOSTSTATED
	tag HOSTSTATED

	table webhosts
	backup table fallback
}

#
# Relay and protocol for HTTP layer 7 loadbalancing and SSL acceleration
#
protocol httpssl {
	protocol http
	header append "$REMOTE_ADDR" to "X-Forwarded-For"
	header append "$SERVER_ADDR:$SERVER_PORT" to "X-Forwarded-By"
	header change "Connection" to "close"

	# Various TCP performance options
	tcp { nodelay, sack, socket buffer 65536, backlog 128 }

#	ssl { no sslv2, sslv3, tlsv1, ciphers HIGH }
#	ssl session cache disable
}

relay wwwssl {
	# Run as a SSL accelerator
	listen on $ext_addr port 443 ssl
	protocol httpssl

	# Forward to hosts in the webhosts table using a src/dst hash
	table webhosts loadbalance
}

#
# Relay and protocol for simple TCP forwarding on layer 7
#
protocol sshtcp {
	protocol tcp

	# The TCP_NODELAY option is required for "smooth" terminal sessions
	tcp nodelay
}

relay sshgw {
	# Run as a simple TCP relay
	listen on $ext_addr port 2222
	protocol sshtcp

	# Forward to the shared carp(4) address of an internal gateway
	forward to $sshhost1 port 22
}

#
# Relay and protocol for a transparent HTTP proxy
#
protocol httpfilter {
	protocol http
	header filter "Mozilla/4.0 (compatible; MSIE *" from "User-Agent"
	response header filter "application/*" from "Content-Type"
}

relay httpproxy {
	# Listen on localhost, accept redirected connections from pf(4)
	listen on 127.0.0.1 port 8080
	protocol httpfilter

	# Forward to the original target host
	nat lookup
}