backend mysql_back balance leastconn option mysql-check user haproxy_check server mysql1 10.0.1.1:3306 check inter 5s rise 3 fall 2 server mysql2 10.0.1.2:3306 check inter 5s rise 3 fall 2 backup
ufw allow from 10.0.1.0/24 to any port 22 proto tcp
ufw allow from 203.0.113.50 to any port 22 proto tcp # Office IP
Allow web
ufw allow 80/tcp
ufw allow 443/tcp
Allow specific services
ufw allow from 10.0.1.0/24 to any port 3306 proto tcp # MySQL from app servers
ufw allow from 10.0.1.0/24 to any port 5432 proto tcp # PostgreSQL from app servers
ufw allow from 10.0.1.0/24 to any port 6379 proto tcp # Redis from app servers
Rate limit SSH
ufw limit 22/tcp
Enable
ufw enable
ufw status verbose
iptables (Advanced)
# Block common attacks
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
SYN flood protection
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP
Block known bad IPs
iptables -A INPUT -s 1.2.3.4 -j DROP
Save rules
iptables-save > /etc/iptables/rules.v4
6. Flowcharts & Decision Diagrams
SSL/TLS Problem Decision Tree
SSL problem? ─┬─ Certificate expired ──→ Auto-renew with certbot, check cron timer
├─ Certificate not trusted ──→ Install full chain (cert + intermediate)
├─ Mixed content ──→ Replace all http:// with https:// in HTML/JS
├─ HSTS issues ──→ Check preload status, clear browser HSTS cache
├─ SNI not configured ──→ Add server_name in nginx, check ssl_preread
├─ Weak ciphers ──→ Update ssl_ciphers to Mozilla Modern profile
└─ OCSP error ──→ Enable ssl_stapling, check resolver in nginx
DNS Problem Decision Tree
DNS not resolving? ─┬─ NXDOMAIN ──→ Check DNS records exist at authoritative NS
├─ SERVFAIL ──→ Check DNSSEC, nameserver connectivity
├─ Timeout ──→ Check firewall allows UDP/TCP 53
├─ Wrong answer ──→ Check TTL expired, flush caches
└─ Works from some locations ──→ Propagation delay (wait for TTL)
Network Troubleshooting Flowchart
Can't connect? ─┬─ ping fails ──→ Firewall, routing, host down
├─ ping works, port fails ──→ Service not listening, firewall
├─ Connection refused ──→ Service not running or wrong port
├─ Connection timeout ──→ Firewall DROP, routing issue
├─ Connection reset ──→ Service crashed, IDS/IPS blocking
└─ Works from localhost ──→ Firewall/iptables rule blocking external
7. Testing Strategy
SSL/TLS Testing
# Test SSL configuration (Qualys SSL Labs alternative)
Using testssl.sh
git clone https://github.com/drwetter/testssl.sh.git
cd testssl.sh
./testssl.sh -E https://api.myapp.com
if [ "$days_left" -lt "$ALERT_DAYS" ]; then echo "⚠️ Certificate for $domain expires in $days_left days!" | \ mail -s "CERT EXPIRY: $domain" admin@myapp.com fi done
for offset in $(seq 0 10000 $(psql -t -c "SELECT COUNT(*) FROM orders")); do
psql -c "INSERT INTO orders_v2 SELECT *, 0 FROM orders ORDER BY id OFFSET $offset LIMIT 10000 ON CONFLICT DO NOTHING;"
sleep 1 # Let replication catch up
done
Step 4: Swap tables in a transaction
psql -c "BEGIN; ALTER TABLE orders RENAME TO orders_old; ALTER TABLE orders_v2 RENAME TO orders; COMMIT;"
Step 5: Drop old table after verification
psql -c "DROP TABLE orders_old;"
Performance Optimization — Protocol & Caching
TLS 1.3 0-RTT — reduce handshake latency by 100ms+ on repeat connections
OCSP Stapling — eliminate CA roundtrip during TLS handshake
HTTP/2 Multiplexing — single connection, multiple streams, no head-of-line blocking
DNS Prefetch —
TCP Fast Open — net.ipv4.tcp_fastopen=3 on both client and server
Best Practices
Always use Full (Strict) SSL mode with Cloudflare — origin cert + Cloudflare cert
Enable HTTP/2 everywhere — single connection multiplexing
Set HSTS with preload — max-age=31536000, includeSubDomains
Use OCSP stapling — reduces TLS handshake latency by 100-300ms
Rate-limit auth endpoints at edge — 5-10 req/min for login, 100 req/s for API
Monitor certificate expiry — alert 30 days before renewal
Use DNS challenge for wildcard certs — easier than HTTP challenge for internal domains
Separate internal and external DNS — split-horizon DNS for security
Real IP restoration — always configure set_real_ip_from behind CDN/proxy
Test SSL configuration regularly — testssl.sh monthly, update cipher suite annually
10. Common Pitfalls
| # | Pitfall | Impact | Fix | |---|---------|--------|-----| | 1 | Missing intermediate cert | Browser shows untrusted | Use fullchain.pem, not cert.pem | | 2 | Not restoring real IP | All traffic appears from proxy | Set real_ip_header CF-Connecting-IP | | 3 | HTTP→HTTPS redirect loop | Cloudflare "too many redirects" | Set SSL mode to Full (Strict) | | 4 | DNS TTL too high | Can't failover quickly | Set TTL to 300-300s for critical records | | 5 | Not rate-limiting SSH | Brute force attacks | ufw limit 22/tcp or fail2ban | | 6 | Mixed content warnings | Browser blocks resources | Replace all http:// in HTML with https:// | | 7 | Weak DH parameters | Logjam attack | Use 2048-bit+ DH params or ECDHE only | | 8 | Not monitoring cert expiry | Service goes down | certbot renew --dry-run + monitoring | | 9 | DNS cache poisoning | Wrong IP responses | Enable DNSSEC, use trusted resolvers | | 10 | Proxy buffers too small | 502 errors on large responses | Increase proxy_buffer_size to 16k |