Proxies and load balancing: HAProxy, Squid
You set up a forward proxy with Squid and a reverse proxy and load balancer with HAProxy, trying health checks, sticky sessions and TLS termination on real backends.
Level 301 · 18 lessons · 15 practice labs
Lessons
Proxies
- Forward, reverse and transparent proxies
- A forward proxy with Squid
- Squid access lists and authentication
- Squid caching and access logs
- Short task: set up an authenticated proxy for an office
Load balancing
- Load-balancing algorithms
- HAProxy: frontend, backend and the basics
- Health checks and taking a backend out
- Sticky sessions
- Layer 4 and layer 7 balancing
- Short task: balance between two backends without interruption
In production
- TLS termination and re-encryption to the backend
- Rate limits and access rules with HAProxy
- The PROXY protocol and keeping the client IP
- Monitoring with the stats page and logs
- Zero-downtime deploys: draining a backend
- Short task: switch to a new version with no downtime
Wrap-up
- Capstone: a redundant entry layer for a web service
Practice labs
- The proxy should serve only the office: Configure Squid to accept requests only from the given office subnet and show curl results from an allowed and a refused client.
- The blocked site still opens: Find the ordering mistake in the Squid access lists, fix the category block and the office-hours rule and prove it with TCP_DENIED entries in access.log.
- Authenticated proxy and cache audit: Build a Squid with username login for Selvi Schools, compute the cache hit ratio from the logs and report the three heaviest users.
- Spread load across two web servers: Define a frontend and a two-server backend in HAProxy, send consecutive requests and show the responses alternating between the servers.
- Traffic still goes to a crashed server: Write an HTTP health check that catches the backend that looks healthy while the application is failing, and show the broken server leaving rotation on the stats page.
- Shopping carts empty at random: Find in the balancing algorithm and session persistence why Cinnamon Café’s online orders lose their carts, set up cookie-based persistence and document what happens when a server fails.
- Terminate HTTPS at the proxy: Attach a certificate to HAProxy, terminate TLS on 443, redirect HTTP to HTTPS and show both with curl.
- Every visitor in the app log is the proxy’s IP: Configure X-Forwarded-For or the PROXY protocol on both sides so the real client address appears in the backend logs, and tell requests from different clients apart in the log.
- A flood of requests on the login page: Limit the lab test tool’s heavy requests to the login page per client with a stick-table, show legitimate users are unaffected and count the blocked requests from the log.
- Take a server out quietly for maintenance: Put a backend into drain state through the runtime API, wait for open connections to finish and show that no request failed in the meantime.
- Switch to a new version without downtime: Move Brightfield Labs’ two backends to the new version one at a time and prove zero errors and the new version’s responses with a loop sending requests throughout.
- The proxy itself is a single point of failure: Make two HAProxy nodes redundant behind a virtual IP, switch off the primary and report the failover to the standby along with the measured request loss.
- Put the application behind a reverse proxy: Put the directly exposed web application behind HAProxy, make the backend reachable only from the proxy and show a direct connection being refused.
- One address, two applications: Write layer 7 rules that route to two different backends by host name and path on a single entry address, balance a database port at layer 4 as well and test each route.
- A third of users complain about slowness: Find the source of the slowness on Tulip Pharmacy’s ordering site from the HAProxy stats page and the timing fields in its logs, isolate the slow backend, adjust the weights and measure the improved response times.
About this course
You set up a forward proxy with Squid and a reverse proxy and load balancer with HAProxy, trying health checks, sticky sessions and TLS termination on real backends.
What you will learn
- Proxies
- Load balancing
- In production
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.