# Load Balancer not allowing both HTTP and HTTPS rules
**URL:** https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194
**Category:** Rancher 1.x
**Created:** [April 19, 2017, 9:24pm UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194 "2017-04-19T21:24:11Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@SJC](https://forums.suse.com/u/SJC)
#### Post date: [April 19, 2017, 9:24pm UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/1 "2017-04-19T21:24:11Z")
I have a service running a simple webpage which I am hosting behind a rancher load balancer. The service does not publish the port, and so has to be accessed through the load balancer.
When setting up the load balancer I specify a rule for HTTP, coming on port 80 publicly, my domain, and routing it to the local port 80 on the service. This works fine, when I visit `http://prefix.domain.com`.
I then attempt to set up a second rule on the load balancer for HTTPS, coming in on port 443, my domain and routing to the local port 80 of the service. When I now navigate to `http://prefix.domain.com` it still works, but when i goto `https://prefix.domain.com` I get a time out. I have the correct ssl certificates hooked up so don’t know what went wrong. I was under the impression the load balancer would compare the incoming request to the rules from top to bottom in order of precedence.
The only work around I can find, is to remove the HTTPS rule and create a second load balancer for that rule.
Any ideas?
---
### Author:  [@sjiveson](https://forums.suse.com/u/sjiveson)
#### Post date: [April 20, 2017, 8:24am UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/2 "2017-04-20T08:24:44Z")
Can you post the compose version of your attempted configuration please?
Also, in your blog piece, I’m unclear why you are checking for a specific path when redirecting to HTTPS?
---
### Author:  [@SJC](https://forums.suse.com/u/SJC)
#### Post date: [April 20, 2017, 12:06pm UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/3 "2017-04-20T12:06:05Z")
The compose for the load-balancer stack are as follows
**Docker-Compose**
```auto
version: '2'
services:
http-lb:
image: rancher/lb-service-haproxy:v0.6.4
ports:
- 80:80/tcp
- 443:443/tcp
labels:
io.rancher.container.agent.role: environmentAdmin
io.rancher.container.create_agent: 'true'
```
**Rancher Compose**
```auto
version: '2'
services:
http-lb:
scale: 1
start_on_create: true
lb_config:
certs: []
default_cert:
port_rules:
- hostname: blue.
priority: 2
protocol: http
service: Blue/Blue
source_port: 80
target_port: 80
- hostname: blue.
priority: 3
protocol: https
service: Blue/Blue
source_port: 443
target_port: 80
health_check:
healthy_threshold: 2
response_timeout: 2000
port: 42
unhealthy_threshold: 3
initializing_timeout: 60000
interval: 2000
reinitializing_timeout: 60000
```
I have the domain of the `HTTPS` because I intend to use this load balancer for multiple hostnames so need to choose the correct HTTPS connection using the domain.
Thanks
---
### Author:  [@sjiveson](https://forums.suse.com/u/sjiveson)
#### Post date: [April 20, 2017, 12:57pm UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/4 "2017-04-20T12:57:34Z")
Looks OK to me. Do you see port 443 exposed on the host?
I think it’s hard to check these days but this should show an suitable entry in the **CATTLE\_PREROUTING** chain of the **nat** table: `sudo iptables --list -t nat -n`
Can you try a `wget...` on the local host?
---
### Author:  [@SJC](https://forums.suse.com/u/SJC)
#### Post date: [April 20, 2017, 1:28pm UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/5 "2017-04-20T13:28:35Z")
I cannot check the entry in CATTLE\_PREROUTING right now, but I will later. I would however expect the port to be open because as I mentioned in my blog post I set up a second LB on the same host which would have allowed traffic on 443.
If you alter the LB stack to be
**Docker Compose**
```auto
version: '2'
services:
https-lb:
image: rancher/lb-service-haproxy:v0.6.4
ports:
- 443:443/tcp
labels:
io.rancher.container.agent.role: environmentAdmin
io.rancher.container.create_agent: 'true'
http-lb:
image: rancher/lb-service-haproxy:v0.6.4
ports:
- 80:80/tcp
labels:
io.rancher.container.agent.role: environmentAdmin
io.rancher.container.create_agent: 'true'
```
**Rancher Compose**
```auto
version: '2'
services:
https-lb:
scale: 1
start_on_create: true
lb_config:
certs: []
default_cert:
port_rules:
- hostname: blue.
priority: 1
protocol: https
service: Blue/Blue
source_port: 443
target_port: 2368
health_check:
healthy_threshold: 2
response_timeout: 2000
port: 42
unhealthy_threshold: 3
initializing_timeout: 60000
interval: 2000
reinitializing_timeout: 60000
http-lb:
scale: 1
start_on_create: true
lb_config:
certs: []
config: "frontend 80 \nacl lepath path_beg -i /.well-known/acme-challenge \
\ \nredirect scheme https code 301 if !lepath !{ ssl_fc }"
port_rules:
- hostname: blue.
priority: 2
protocol: http
service: Blue/Blue
source_port: 80
target_port: 80
health_check:
healthy_threshold: 2
response_timeout: 2000
port: 42
unhealthy_threshold: 3
initializing_timeout: 60000
interval: 2000
reinitializing_timeout: 60000
```
This works
---
### Author:  [@sjiveson](https://forums.suse.com/u/sjiveson)
#### Post date: [April 20, 2017, 2:20pm UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/6 "2017-04-20T14:20:34Z")
Understood that it works as two separate LBs, it just might help narrow things down if we know it at least listens and responds (locally) on 443.
---
### Author:  [@SJC](https://forums.suse.com/u/SJC)
#### Post date: [April 20, 2017, 9:18pm UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/7 "2017-04-20T21:18:11Z")
Looking at the CATTLE\_PREROUTING chain of the nat table, I see the entries for 443
```auto
...
MARK tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 MARK set 0x1068
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to::443
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ADDRTYPE match dst-type LOCAL to::443
...
```
---
### Author:  [@sjiveson](https://forums.suse.com/u/sjiveson)
#### Post date: [April 21, 2017, 9:56am UTC](https://forums.suse.com/t/load-balancer-not-allowing-both-http-and-https-rules/6194/8 "2017-04-21T09:56:04Z")
OK, interesting, no issue there then. So, does a `wget` work locally on the host then?
It would also be worth getting a shell in the lb container, checking that is also listening on 443 with `ss -ltn` and also taking a look at the generated **/etc/haproxy/haproxy.cfg** file to see if anything is wrong there.