How to Configure Azure Front Door and Integrate It with HAProxy (Complete Step-by-Step Guide)

If you’re hosting websites or applications behind an Azure Virtual Machine and using HAProxy as your reverse proxy/load balancer, adding Azure Front Door is one of the best upgrades you can make for performance, security, and global availability.

In this guide, you’ll learn how to:

Configure Azure Front Door
Connect it to an Azure VM running HAProxy
Configure DNS
Secure your origin server
Troubleshoot common errors like 502 Bad Gateway, OriginCertificateChainError, and DNS issues

What is Azure Front Door?

Azure Front Door is Microsoft’s global edge application delivery platform that provides:

Global load balancing
SSL offloading
Web Application Firewall (WAF)
DDoS protection
URL routing
CDN acceleration
Health probes
Fast global access

It sits in front of your application and routes users to your backend securely.

Architecture Example

User Browser
     ↓
Azure Front Door
     ↓
HAProxy on Azure VM
     ↓
WordPress / Node.js / APIs / Apps

Why Use HAProxy Behind Azure Front Door?

HAProxy gives you powerful local traffic control:

Multi-domain routing
Backend load balancing
SSL termination
Path-based routing
Header rewriting
Sticky sessions
Internal service proxying

Azure Front Door + HAProxy = Enterprise-grade edge + backend control.

Prerequisites

Before starting, make sure you have:

Azure subscription
Azure VM with Ubuntu
Public IP
HAProxy installed
Domain name (example: example.com)
Access to DNS provider (GoDaddy, Cloudflare, etc.)
Open ports 80 and 443

Step 1 – Install HAProxy on Ubuntu

SSH into your VM:

sudo apt update
sudo apt install haproxy -y

Enable service:

sudo systemctl enable haproxy
sudo systemctl start haproxy

Check status:

sudo systemctl status haproxy

Step 2 – Basic HAProxy Configuration

Edit config:

sudo vi /etc/haproxy/haproxy.cfg

Example:

global
    log /dev/log local0
    daemondefaults
    mode http
    timeout connect 5s
    timeout client 50s
    timeout server 50sfrontend http
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }frontend https
    bind *:443 ssl crt /etc/ssl/private/site.pem
    mode http
    option forwardfor
    http-request set-header X-Forwarded-Proto https    acl host_blog hdr(host) -i example.com www.example.com
    use_backend wordpress_backend if host_blogbackend wordpress_backend
    mode http
    server wp1 10.1.3.100:8080 check

Validate:

sudo haproxy -c -f /etc/haproxy/haproxy.cfg

Reload:

sudo systemctl reload haproxy

Step 3 – Create Azure Front Door

In Azure Portal:

Create Resource

Search:

Azure Front Door and CDN Profiles

Click:

Create

Choose:

Tier: Standard or Premium

Enter:

Resource Group
Name
Endpoint Name

Create.

Step 4 – Add Origin Group

Go to:

Front Door Manager → Origin Groups

Create:

Name: og-haproxy

Add origin:

Type: Custom
Host name: public hostname or origin DNS
Example: origin.example.com

Avoid using raw IP if possible.

Set:

HTTP: 80
HTTPS: 443

Step 5 – Why Use Origin Hostname Instead of IP?

Using an IP often causes TLS errors such as:

OriginCertificateChainError
Certificate mismatch
SSL handshake failures

Best practice:

origin.example.com → VM Public IP

Then use a certificate for origin.example.com.

Step 6 – Add Custom Domain

Go to:

Domains

Add:

example.com
www.example.com

Azure may ask for TXT validation record:

_dnsauth.example.com

Add it in your DNS provider.

Step 7 – DNS Configuration

Root Domain

Use:

ALIAS / ANAME / Flattening

Point to:

yourendpoint.z02.azurefd.net

WWW Domain

Use CNAME:

www → yourendpoint.z02.azurefd.net

Step 8 – Create Route

Go to:

Routes

Create route:

Domains: example.com, www.example.com
Pattern: /*
Origin Group: og-haproxy
Protocols: HTTP + HTTPS

Enable:

Redirect HTTP → HTTPS

Step 9 – Enable WAF

Go to:

Security Policies

Create WAF policy.

Recommended:

Prevention Mode
Latest managed rules
Bot protection
Rate limiting

Step 10 – Protect HAProxy Origin from Direct Access

Azure NSG Rules

Allow:

Source: AzureFrontDoor.Backend
Ports: 80,443

Deny:

Source: Internet
Ports: 80,443

This ensures only Front Door can reach your VM.

Step 11 – Validate Azure Front Door in HAProxy

Azure Front Door sends header:

X-Azure-FDID

Use it in HAProxy:

acl from_afd req.hdr(X-Azure-FDID) -m str YOUR-FRONTDOOR-ID
http-request deny deny_status 403 if !from_afd

Get Front Door ID from Azure portal Overview page.

Full Secure Frontend Example

frontend https
    bind *:443 ssl crt-list /etc/ssl/private/crt-list.txt alpn h2,http/1.1
    mode http
    option forwardfor    http-request set-header X-Forwarded-Proto https
    http-request set-header X-Forwarded-Host %[req.hdr(host)]    acl from_afd req.hdr(X-Azure-FDID) -m str d3e4040d-1318-462f-b168-a17f07d289f1
    http-request deny deny_status 403 if !from_afd    acl host_main hdr(host) -i example.com www.example.com
    use_backend wordpress_backend if host_main    http-request deny deny_status 403

Common Troubleshooting 1. 502 Bad Gateway

Cause

Front Door cannot connect to origin.

Fix

Check:

curl -vk https://origin.example.com

Check HAProxy listening:

sudo ss -tulpn | grep :443

2. OriginCertificateChainError

Cause

Bad certificate chain.

Fix

Use full chain PEM:

Private Key
Server Certificate
Intermediate Certificate

Check:

openssl s_client -connect origin.example.com:443 -servername origin.example.com -showcerts

3. Wrong Certificate (azureedge.net)

Cause

Custom domain not fully provisioned.

Fix

Wait for:

Validation approved
Certificate issued

4. DNS Not Working

Check:

nslookup example.com
nslookup www.example.com

5. Redirect Loops

Ensure backend app trusts:

X-Forwarded-Proto
X-Forwarded-Host

Performance Tips

Enable caching for:

images
css
js
fonts

Disable caching for:

admin
login
APIs

Security Best Practices

Use:

TLS 1.2+
WAF Prevention Mode
Geo blocking
Rate limiting
Header validation
NSG restrictions
Origin hidden from public

Monitoring

Enable logs to:

Azure Monitor
Log Analytics
Sentinel

Track:

403 spikes
502 errors
Attack attempts
High latency
Country anomalies

Final Production Checklist

✅ Azure Front Door deployed
✅ Domain validated
✅ SSL working
✅ Route configured
✅ HAProxy integrated
✅ NSG locked down
✅ WAF enabled
✅ Redirects working
✅ Monitoring enabled

Conclusion

Azure Front Door combined with HAProxy creates a highly secure and scalable architecture for websites, APIs, and enterprise applications.

You get:

Faster websites
Better security
Global performance
Origin protection
Flexible routing

How to Configure Azure Front Door and Integrate It with HAProxy (Complete Step-by-Step Guide)