Re: [Proftpd-user] ProxyPassReverseServers option combined with IfClass directive

> I have set up a reverse proxy several years ago with the following 
> configuration:
> 
> ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
> ProxyReverseServers ftp://ftps.xxxx.yyy.it
> 
> Where /usr/local/proftpd/var/ftp/proxy/backends contains only one file 
> anonymous.json
> 
> This configuration allows me to forward anonymous connections to a 
> specific backend server while all others are redirected to 
> ftp://ftps.xxxx.yyy.it
> 
> This has been working perfectly for years.

Excellent!  I'm always gratified to hear about successful use cases for the mod_proxy module.

> Now, I would need to segregate the backend servers based on the 
> connecting IP address. Anonymous connections should still be redirected 
> to a specific backend while all others should be redirected to two 
> different backend servers depending on the connecting IP address.
> 
> I tried the following configuration and several variations but without 
> any success:
> 
> <Class netA>
> From 192.168.0.0/16
> </Class netA>
> ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
> <IfClass netA>
>     ProxyReverseServers ftp://ftpa.ddddd.ooo.it
> </IfClass>
> <IfClass !netA>
>     ProxyReverseServers ftp://ftps.xxxx.yyy.it
> </IfClass>
>  
> In this example the setting _*ProxyReverseServers 
> file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json*_ is 
> systematically ignored and the connection is forwarded to 
> ftp://ftpa.ddddd.ooo.it or ftp://ftps.xxxx.yyy.it depending on the 
> connecting IP address.

Hmm.  I wonder if this is somehow related to the order that these configuration records appear in the internal in-memory tree -- and thus the order in which they are retrieved and used.  The mod_ifsession code, which merges in these conditional configuration sections, may be creating a different order of those configuration records.

To verify this hypothesis, here is a possible different configurations you might try: you might add the %U.json using directive inside each of the <IfClass> sections:

  <Class netA>
    From 192.168.0.0/16
  </Class netA>

  <IfClass netA>
    ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
    ProxyReverseServers ftp://ftpa.ddddd.ooo.it
  </IfClass>
  <IfClass !netA>
    ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
    ProxyReverseServers ftp://ftps.xxxx.yyy.it
  </IfClass>

The idea here being to see if this approach restores the ordering that your original config used.  Yes, it is not as aesthetically pleasing due to the apparent duplication of records.

Hope this helps,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html