HAProxy
[ReverseProxy]

RemoteViz and HAProxy

Summary

RemoteViz uses WebSocket protocol to make possible the communication between the client and the service. In production environments, the network traffic can be routed through a reverse proxy to guarantee security so that no information about your backend servers be visible outside your internal network. This document explains how to configure HAProxy as reverse proxy to route WebSocket requests to the RemoteViz service and web page requests to the web server over the same port and domain.

Compatibility

HAProxy supports Websocket proxing from the version 1.4.

HAProxy Installation

Please refer to the HAProxy official documentation to install HAProxy:

For Unix systems: http://www.haproxy.org/#down

HAProxy Configuration

In the next section, we consider that the front-end is bound to yourdomain:80 (public), the web server (Apache, NGinx, IIS, ...) is bound to 10.0.0.1:8000 (behind a firewall) and the RemoteViz service is bound to 10.0.0.2:8080 (behind a firewall). There are three ways to proxy WebSocket connections through HAProxy.

Proxy based on sub-domain

In this case, the websocket connection is differentiated from other requests by using a sub-domain. In the below example, all traffic going to remoteviz.yourdomain will be redirected to the RemoteViz service.

   frontend public
    bind *:80
    acl is_websocket hdr_end(host) -i remoteviz.yourdomain
    use_backend ws if is_websocket
    default_backend www

   backend www
    timeout server 30s
    server www1 10.0.0.1:8000

   backend ws
    timeout server 600s
    server ws1 10.0.0.2:8080
 

The websocket connection address has to be modified in the HTML client file. In the file index.html, replace the line:

    theRenderArea.connectTo("ws://127.0.0.1:8080/RenderAreaName");
 

by the line:

    theRenderArea.connectTo("ws://remoteviz.yourdomain/RenderAreaName");
 

Proxy based on URI

An alternative to the above setup is to proxy based on the URI. In the below example, all traffic going to yourdomain/remoteviz will be redirected to the RemoteViz service.

   frontend public
    bind *:80
    acl is_example hdr_end(host) -i yourdomain
    acl is_websocket path_beg -i /remoteviz
    use_backend ws if is_websocket is_example
    default_backend www

   backend www
    timeout server 30s
    server www1 10.0.0.1:8000

   backend ws
    timeout server 600s
    server ws1 10.0.0.2:8080
 

The websocket connection address has to be modified in the HTML client file. In the file index.html, replace the line:

    theRenderArea.connectTo("ws://127.0.0.1:8080/RenderAreaName");
 

by the line:

    theRenderArea.connectTo("ws://yourdomain/remoteviz/RenderAreaName");
 

Proxy using websocket detection

The last case uses an automatic detection of the websocket request by examining the HTTP header for the Upgrade: WebSocket line. All websocket traffic will be redirected to the RemoteViz service.

   frontend public
    bind *:80
    acl is_websocket hdr(Upgrade) -i WebSocket
    use_backend ws if is_websocket is_websocket_server
    default_backend www

   backend www
    timeout server 30s
    server www1 10.0.0.1:8000

   backend ws
    timeout server 600s
    server ws1 10.0.0.2:8080
 

The websocket connection address has to be modified in the HTML client file. In the file index.html, replace the line:

    theRenderArea.connectTo("ws://127.0.0.1:8080/RenderAreaName");
 

by the line:

    theRenderArea.connectTo("ws://yourdomain/RenderAreaName");