Fast Reverse Proxy

RouterOS General
1

I am wondering if anyone besides myself thinks something like FRP would be of great benefit? This would allow you to reverse proxy to a public server any kind of traffic, not just http. Or, is there something in RouterOS that already lets you do this and I just missed it??

Quick overview of FRP:

  • Run frps on a machine on a public server with minimal configuration
  • Run frpc inside your network with an INI file which contains what you are forwarding
  • You would then connect to the frps (public ip) to get access to the resource inside your network
  • It can run as a Windows Service and runs on ARM/Linux, etc…

https://github.com/fatedier/frp

2

I am using HAProxy. I have 8-10 web services on various host, with different ports.
HAProxy redirects by looking at the URL and send it to correct server on server ports.
It can be used in many other ways.

3

I’m trying to do the same with haproxy. Could you share the setup ? Thanks in advance

4

Here is some of my code. Enough to make it work:

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

# Eneble web statistics
listen stats
        bind *:1936
        mode http
        stats enable
        stats hide-version
        stats realm Haproxy\ Statistics
        stats uri /
        stats auth jotne:Provider

# input redirect
frontend http-in
        bind *:80

        # Define a rule to use based on domain name
        acl is_splunk hdr_end(host) -i splunk.demo.com
        acl is_www hdr_end(host) -i www.demo.com
        acl is_cam hdr_end(host) -i cam.demo.com


        # Redirect to correct server based on rule to use
        use_backend srv_splunk if is_splunk
        use_backend srv_www if is_www
        use_backend srv_cam if is_cam
        default_backend default


backend srv_splunk
        option httpclose
        option forwardfor
        server Local 192.168.10.50:8000

backend srv_www
        option httpclose
        option forwardfor
        server Local 192.168.10.32:80

backend srv_cam
        option httpclose
        option forwardfor
        server Local 192.168.10.26:8080

backend default
        option httpclose
        option forwardfor
        server Local 192.168.10.104:80
5

A simple reverse proxy implementation would be great. FRP is an amazing little package, I use it regularly! But that obviously requires another device like a raspberry pi in addition to the Mikrotik. Something built-in would be great. AFAIK there’s no way to implement a reverse port forward in Mikrotik using any of the standard routing or firewall tricks so providing this type of functionality would require the specific functionality to be built in

6

I understand the need for reverse proxy (I’d vote for optional nginx package myself, that could do wonders). But I fail to see why should I want FRP with this whole client-server architecture, what’s the point?