How to Configure Multiple HAProxy Frontends Binding to Same Port (Port 80 and Range 2000-5000) – Best Practices


3 views

When working with HAProxy configurations, a common scenario arises where you need multiple frontends to listen on the same port (like port 80) while having additional port requirements. The key question is whether HAProxy can reliably handle this configuration pattern.

While HAProxy technically allows multiple frontends to bind to the same port (as shown in your example), this approach can lead to unpredictable behavior in practice. Here's why:

frontend http_main
    bind :80
    bind :2000-5000
    acl is_service_A path_beg /api/v1
    acl is_service_B path_beg /dashboard
    use_backend servers_A if is_service_A
    use_backend servers_B if is_service_B
    default_backend servers_default

The most reliable approach is to consolidate into a single frontend with proper ACL rules:

frontend unified_frontend
    bind :80
    bind :2000-5000
    
    # Service A rules
    acl host_a hdr(host) -i servicea.example.com
    acl port_a dst_port 2000-5000
    
    # Service B rules
    acl host_b hdr(host) -i serviceb.example.com
    
    use_backend backend_a if host_a || port_a
    use_backend backend_b if host_b
    default_backend maintenance

For more complex scenarios, consider these patterns:

# Using path-based routing
acl api_path path_beg /api/v2
acl admin_path path_beg /admin

# Using header values
acl mobile_app hdr(User-Agent) -i MobileApp

# Combining multiple conditions
use_backend mobile_backend if mobile_app api_path

Since you're using HAProxy 1.5 (which is quite old), be aware that newer versions (1.8+) offer better options like:

  • More sophisticated ACL combinations
  • Improved connection handling
  • Better logging for troubleshooting

If you must maintain separate frontends:

  1. Verify bind order in configuration
  2. Check ACL evaluation sequence
  3. Monitor connection handling statistics
  4. Test with explicit 'default_backend' declarations

When working with HAProxy, a common scenario arises where you need multiple frontends to listen on the same port (like port 80) while maintaining different routing rules. This becomes particularly relevant when:

  • Different applications need to share a common port
  • You want to maintain separate configuration blocks for organizational purposes
  • Certain services require additional port ranges while others don't

In HAProxy 1.5 and later versions, binding multiple frontends to the same port can lead to unpredictable behavior. The configuration you described:

frontend A
    bind :80
    bind :2000-5000
    acl rule_about_A
    use_backend server_A if rule_about_A

frontend B
    bind :80
    acl rule_about_B
    use_backend server_B if rule_about_B

May cause HAProxy to sometimes apply the wrong routing rules because the frontends compete for the same port binding.

Option 1: Single Frontend with Comprehensive ACLs

The most reliable approach is to consolidate into a single frontend with well-structured ACLs:

frontend main
    bind :80
    bind :2000-5000
    
    # Rules for service A
    acl is_service_A hdr(host) -i a.example.com
    acl is_service_A_port dst_port 2000:5000
    use_backend server_A if is_service_A or is_service_A_port
    
    # Rules for service B
    acl is_service_B hdr(host) -i b.example.com
    use_backend server_B if is_service_B

Option 2: Use Name-based Virtual Hosts

For HTTP traffic, leverage host headers for routing:

frontend http-in
    bind :80
    mode http
    
    acl host_a hdr(host) -i a.example.com
    acl host_b hdr(host) -i b.example.com
    
    use_backend servers_a if host_a
    use_backend servers_b if host_b
    default_backend servers_default

Option 3: TCP Layer Separation

For non-HTTP services, consider TCP mode separation:

frontend tcp_services
    bind :2000-5000
    mode tcp
    default_backend tcp_backend

frontend http_services
    bind :80
    mode http
    default_backend http_backend

When consolidating frontends:

  • ACL processing is optimized in recent HAProxy versions
  • Single frontend reduces memory overhead
  • Simplified configuration improves maintainability

For HAProxy 1.5 users:

  • Stick to single frontend approach for stability
  • Consider upgrading for better ACL performance
  • Multiple bind statements in one frontend are fully supported