https to http redirect

Forums Technical Forums
, , ,
1

Hello

I have the following Problem.

What ist running at the moment:

→

→

→

Every Request to the “url”, even on Port 80 must be redirected to https.

We have two virtual Servers, same IP, one ist listening on Port 80, the other on Port 443.

The Virtual Server on Port 80 has the iRule _sys_https_redirect for redirecting to Port 443.

The Virtual Server on Port 443 redirect depending on the uri to a pool.

Works perfect :slight_smile:

In the future it should look like this:

→ (still the same as before)

→ or (NLB for 2 Servers)

→ or (NLB for 2 Servers)

I was able to configure it if everything was redirected with https.

I created https class Profiles, linked to the virtual Server listening on Port 443 and sent the request to 2 different Pools. this worked great.

/uri1 was always redirected to server1 and /uri2 was reidirected between ServerA and ServerB.

But now I have to redirect the some uri with http.

How can I solve this?

One big iRule for everything or should it also work with http classes, Pools or redirects?

I treid both but got lost.

Any Help is appreciated.

Best Regards,

Roger

2

Hi aschi,

You could solve your problem with httpclass Profiles or iRules, do you have a preference?

iRule Method:

On your HTTP Virtual Server, modify your HTTP to HTTPS Redirect iRule to look at the [HTTP::uri] before it takes any action. If “/uri1” redirect, if “/uri2” or “/uri3” send to the server pools for each.

On your HTTPS Virtual Server, apply the reverse logic of the previous iRule.

If you want to combine them into a single iRule you can do that as well using the “if {[TCP::local_port] == 443 }” approach and separate the logic. Also, make sure you have a default action (I assume that you would want the default action to perform an HTTP to HTTPS redirect to somewhere).

httpclass Method:

Each httpclass can match on the Host and/or URI Value. You can create the same type of logic used in the iRules to serve the same purpose.

httpclass1 = On HTTP Virtual Server detect “/uri1” and perform a redirect.

httpclass2 = On HTTPS Virtual Server detect “/uri2” and redirect to HTTP.

httpclass3 = On HTTPS Virtual Server detect “/uri3” and redirect to HTTP.

You could create a final httpclass to apply on your HTTP Virtual Server to perform a generic HTTP to HTTPS Redirect (just make sure it is the final httpclass in the stack (once an httpclass matches it will process the request and not process any further httpclasses).

Hope this helps.

3

hi Michael

Thanks for your explanations.

I tried it frist with the httpclass Method but it wasn’t successfull. Not sure where the Problem was. Troubleshotting seems to me very difficult to find the Problem.

So I startet with iRules.

This works so far great but there one last Problem:

http://url/uri1 → http://server1/uri1

https://url/uri1 → https://server1/uri1

http://url/uri2 → http://serverA/uri2 or http://serverB/uri2

https://url/uri2 → http://serverA/uri2 or http://serverB/uri2

But the Problem is the from the Client side is must keep https. How do I terminate the https and go with http to the two Servers?

Terminating the ssl has to be done with the ssl Profile but how do I have to configure it that I am able to choss between http and http from the LTM to the webserver?

I used the following iRule for http Host:

when HTTP_REQUEST {

if { [HTTP::uri] starts_with “/uri2” } {

use pool ACA-Pool_NLB-Test_2Nodes_http

} else {

HTTP::redirect https://[HTTP::host][HTTP::uri] }

}

And for the https Host the following:

when HTTP_REQUEST {

if { [HTTP::uri] starts_with “/uri1” } {

use pool ACA-Pool_NLB-Test_https

} elseif { [HTTP::uri] starts_with “/uri2” } {

HTTP::redirect http://[HTTP::host][HTTP::uri]

use pool ACA-Pool_NLB-Test_2Nodes_http

} else {

use pool ACA-Pool_NLB-Test_2Nodes_https }

}

4

is it something like this?

http virtual server

[root@ve10:Active] config  b virtual bar80 list
virtual bar80 {
   destination 172.28.19.252:80
   ip protocol 6
   rules https_redirect_rule
   profiles {
      http {}
      tcp {}
   }
}
[root@ve10:Active] config  b rule https_redirect_rule list
rule https_redirect_rule {
   when HTTP_REQUEST {
        HTTP::redirect "https://[HTTP::host][HTTP::uri]"
}
}

 https virtual server

[root@ve10:Active] config  b virtual bar443 list
virtual bar443 {
   snat automap
   destination 172.28.19.252:443
   ip protocol 6
   rules myrule
   profiles {
      clientssl {
         clientside
      }
      http {}
      serverssl {
         serverside
      }
      tcp {}
   }
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
  set host [HTTP::host]
  set uri [HTTP::uri]
  switch [string tolower [HTTP::path]] {
    "/uri1" {
      pool server1
    }
    "/uri2" -
    "/uri3" {
      SSL::disable serverside
      pool server23
    }
    default {
       do something
    }
  }
}
when HTTP_RESPONSE {
  log local0. "conn [IP::client_addr]:[TCP::client_port] > [clientside {IP::local_addr}]:[clientside {TCP::local_port}] > [IP::remote_addr]:[TCP::remote_port] | host $host | uri $uri | pool [LB::server pool]"
}
}
[root@ve10:Active] config  b pool server1 list
pool server1 {
   members 200.200.200.101:443 {}
}
[root@ve10:Active] config  b pool server23 list
pool server23 {
   members {
      200.200.200.101:80 {}
      200.200.200.111:80 {}
   }
}

 test

[root@ve10:Active] config  cat /var/log/ltm
Mar  7 22:00:51 local/tmm info tmm[22185]: Rule myrule : conn 172.28.19.251:44555 > 172.28.19.252:443 > 200.200.200.101:443 | host 172.28.19.252 | uri /uri1 | pool server1
Mar  7 22:00:53 local/tmm info tmm[22185]: Rule myrule : conn 172.28.19.251:44556 > 172.28.19.252:443 > 200.200.200.101:80 | host 172.28.19.252 | uri /uri2 | pool server23
Mar  7 22:00:54 local/tmm info tmm[22185]: Rule myrule : conn 172.28.19.251:44557 > 172.28.19.252:443 > 200.200.200.111:80 | host 172.28.19.252 | uri /uri3 | pool server23
5

Hi

Thanks a lot, you saved my day.

At the end, with your help of course, it was very easy.

the Trick as you mentinod was: SSL::disable serverside

Best Regards,

Roger