I have no internet connectivity in freshly installed PfSense system.
Steps:

1. I've created OVH instance with Ubuntu and I mounted mfsbsd image.
2. After booting to mfsbsd there was also internet problem. Couldn't download anything or ping at all.
3. I copied PfSense image through SSH using local network.
4. I installed PfSense with UFS BIOS option.
5. Using OVH console I can see that PfSense booted properly after restart. I configured also reverse proxy on nginx using other server in the same local network (http://192.168.10.22/ --> https://pfsense.domain.com/). After that I can reach GUI through pfsense.domain.com URL, but there's an error after logging in and I can't do anything in UI:

An HTTP_REFERER was detected other than what is defined in System > Advanced (https://pfsense.domain.com/). If not needed, this check can be disabled in System > Advanced > Admin Access.

6. After logging in to PfSense server using console I noticed that there's also network connectivity problem.
7. Some outputs:

[2.5.2-RELEASE][[email protected]]/root: ifconfig
    vtnet0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
            options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
            ether xx:xx:xx:xx:xx:xx
            inet6 xxxx::xxxx:xxxx:xxxx:xxxx%vtnet0 prefixlen 64 scopeid 0x1
            inet 123.123.123.123 netmask 0xffffffff broadcast 123.123.123.123
            media: Ethernet 10Gbase-T <full-duplex>
            status: active
            nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
    vtnet1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
            options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
            ether xx:xx:xx:xx:xx:xx
            inet6 xxxx::xxxx:xxxx:xxxx:xxxx%vtnet1 prefixlen 64 scopeid 0x2
            inet 192.168.10.22 netmask 0xffffff00 broadcast 192.168.10.255
            media: Ethernet 10Gbase-T <full-duplex>
            status: active
            nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
    enc0: flags=0<> metric 0 mtu 1536
            groups: enc
            nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
            options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
            inet6 ::1 prefixlen 128
            inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
            inet 127.0.0.1 netmask 0xff000000
            groups: lo
            nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
    pflog0: flags=100<PROMISC> metric 0 mtu 33160
            groups: pflog
    pfsync0: flags=0<> metric 0 mtu 1500
            groups: pfsync

[2.5.2-RELEASE][[email protected]]/root: netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags     Netif Expire
123.123.123.123    link#1             UHS         lo0
123.123.123.123/32 link#1             U        vtnet0
127.0.0.1          link#4             UH          lo0
192.168.10.0/24    link#2             U        vtnet1
192.168.10.22      link#2             UHS         lo0
213.186.33.99      xx:xx:xx:xx:xx:xx  UHS      vtnet0

Internet6:
Destination                       Gateway                       Flags     Netif Expire
::1                               link#4                        UH          lo0
fe80::%vtnet0/64                  link#1                        U        vtnet0
fe80::xxxx:xxxx:xxxx:xxxx%vtnet0  link#1                        UHS         lo0
fe80::%vtnet1/64                  link#2                        U        vtnet1
fe80::xxxx:xxxx:xxxx:xxxx%vtnet1  link#2                        UHS         lo0
fe80::%lo0/64                     link#4                        U           lo0
fe80::1%lo0                       link#4                        UHS         lo0

[2.5.2-RELEASE][[email protected]]/root: ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
ping: sendto: No route to host
ping: sendto: No route to host
ping: sendto: No route to host

[2.5.2-RELEASE][[email protected]]/root: ping serverfault.com
ping: cannot resolve serverfault.com: Host name lookup failure

8. I checked /etc/defaults/rc.conf and options defaultrouter and gateway_enable were set to NO. I changed them to YES, but It didn't help after rebooting.

I can't establish VPN connection between AWS EC2 instance and OVH Public Cloud. In /var/log/syslog there's no errors - just some info about wg-quick operations like adding routing etc.

AWS EC2 instance:

• OS: Ubuntu 20.04.2 LTS

• Internal IP Address: ex. 10.0.22.22/16 ens4

• Public IP Address: ex. 123.123.123.123/32 aws public interface

• Port 12345/udp and 12345/tcp opened via Security group

• Config:
  /etc/wireguard/wg0.conf:

  [Interface]
  Address = 10.10.0.1/24
  SaveConfig = false
  PrivateKey = <aws-private-key>
  ListenPort = 12345
  PostUp   = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens4 -j MASQUERADE;  
  PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens4 -j MASQUERADE;
  
  [Peer]
  PublicKey = <ovh-public-key>
  AllowedIPs = 10.10.0.2/24, 192.168.10.0/16
  Endpoint = 321.321.321.321:12345
  

OVH Public Cloud instance:

• OS: Ubuntu 21.04

• Internal IP Address: ex. 192.168.10.100/16 enp0s2

• Public IP Address: ex. 321.321.321.321/32 enp0s1

• Port 12345/udp and 12345/tcp opened via ufw

• Config:
  /etc/wireguard/wg0.conf:

  [Interface]
  Address = 10.10.0.2/24
  SaveConfig = false
  PrivateKey = <ovh-private-key>
  ListenPort = 12345
  PostUp   = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s1 -j MASQUERADE;  
  PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s1 -j MASQUERADE;
  
  [Peer]
  PublicKey = <aws-public-key>
  AllowedIPs = 10.10.0.1/24, 10.0.0.0/16
  Endpoint = 123.123.123.123:12345
  

Both instances:

• net.ipv4.ip_forward=1 in /etc/sysctl.conf
• command: wg-quick up /etc/wireguard/wg0.conf
• both are running and have created wg0 interfaces with IPs from wg0.conf

Summary:

• curl to app listening on opened port 80/tcp doesn't work on both sides.

Am I missing something? How can I debug this? I've read several articles, but I can't figure it out.

UPDATE:

Communication is working after modifying /etc/wireguard/wg0.conf:
from AllowedIPs = 10.10.0.x/24, (...) to AllowedIPs = 10.10.0.x/32, (...)
as @Tom Yan suggested.

But I'm struggling with routing. This is how does it look with pings to other servers that are in the same networks as VPN Servers.

In AWS I added to routing table the rule:
192.168.10.0/16 via AWS-VPN-interface

In OVH-some-instance I ran:
ip route add 10.0.0.0/16 via 192.168.10.100 dev eno4

The summary of pinging:

OVH-VPN             -> AWS-VPN              OK
OVH-VPN             -> AWS-some-instance    timeout
OVH-some-instance   -> AWS-VPN              OK
OVH-some-instance   -> AWS-some-instance    timeout

AWS-VPN             -> OVH-VPN              OK
AWS-VPN             -> OVH-some-instance    OK
AWS-some-instance   -> OVH-VPN              timeout
AWS-some-instance   -> OVH-some-instance    timeout

In logs I can see only informations:

$: dmesg -wH
[Jul20 13:40] wireguard: wg0: Receiving keepalive packet from peer 5 (123.123.123.123:12345)

IPTables & Routing

AWS-VPN:

$: iptables-save
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -i wg0 -j ACCEPT
-A FORWARD -o wg0 -j ACCEPT

$: ip route
default via 10.0.22.1 dev ens4 proto dhcp src 10.0.22.22 metric 100 
10.0.22.0/19 dev ens4 proto kernel scope link src 10.0.22.22 
10.0.22.1 dev ens4 proto dhcp scope link src 10.0.22.22 metric 100 
10.10.0.2 dev wg0 scope link 
192.168.10.0/16 dev wg0 scope link 

### AWS Console Panel rules for AWS-VPN server
Custom TCP      TCP 12345   321.321.321.321/32
Custom UDP      UDP 12345   321.321.321.321/32
All traffic     All All     321.321.321.321/32
All traffic     All All     10.0.0.0/16
All traffic     All All     192.168.10.0/16
All traffic     All All     10.10.0.2/32

OVH-VPN:

$: iptables-save
*filter
:INPUT ACCEPT [26612:55893110]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [34036:3715836]
-A FORWARD -i wg0 -j ACCEPT
-A FORWARD -o wg0 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [69:5450]
-A POSTROUTING -o enp0s1 -j MASQUERADE
COMMIT

$: ip route
default via 321.321.321.1 dev enp0s1 proto dhcp src 321.321.321.321 metric 100 
10.0.0.0/16 dev wg0 scope link 
321.321.321.1 dev enp0s2 proto dhcp scope link src 321.321.321.321 metric 100 
169.254.169.254 via 192.168.10.2 dev enp0s2 proto dhcp src 192.168.10.100 metric 100 
10.10.0.1 dev wg0 scope link 
192.168.10.0/16 dev enp0s2 proto kernel scope link src 192.168.10.100

$: firewall-cmd --list-all-zones
# I removed empty lines
internal (active)
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 10.0.0.0/16 10.10.0.1/32 123.123.123.123/32
  services: dhcpv6-client mdns ssh
  ports: 12345/tcp 12345/udp
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 123.123.123.123/32
  services: dhcpv6-client ssh
  ports: 12345/tcp 12345/udp

What else should I do to make it work?

I'm testing repmgr tool and I'm a little bit confused. Everything's fine until standby register step.

What should I have configured on standby server? From docs I assumed that standby should't have the cluster, but it didn't configure a new one. When the postgres cluster exists repmgr have a problem with existing data. When I'll stop the cluster service and delete the data manually and run the migration from repmgr I have an error after starting the cluster:

postgres@ip-10-0-34-147:~$ /usr/lib/postgresql/13/bin/pg_ctl -D /var/lib/postgresql/13/main start
waiting for server to start....postgres: could not access the server configuration file "/var/lib/postgresql/13/main/postgresql.conf": No such file or directory
 stopped waiting
pg_ctl: could not start server
Examine the log output.

It's running on Ubuntu, but maybe more applicable will be Debian. But I still have no idea how to make it right.

Webcon cannot see any IIS site provided by SharePoint on creating alias step, but I was able to select proper SharePoint web-application and it installed all Webcon solutions successful.

It should create an alias under SharePoint site, just like that: https://portal.sharepoint.com/WEBCONBPS, but to be able to do this the SharePoint site (in IIS) should be visible. Installation account, IIS web-pool account and even farm account: they all have db_owner role on SQL Server instance for each database, farm administrator and site-collection administrator permission in the SharePoint farm and they all are local administrators across the all farm servers (for testing purposes).

There are four servers in this farm (first-second frontend role, third-fourth application role).

I guess it's not a SharePoint related problem, but still can't figure it out.

I can login to SQL Server 2019 (installed on Debian Buster) with SA account using SQL Management Studio on Windows Server 2016, but I cannot do this with the domain account using integrated authentication.

1. The DebianVM (hyper-v) has joined to Active Directory and the domain account can login through SSH to that server.

2. I have successfully installed SQL Server 2019 and created the instance on the DebianVM.

3. I have successfully logged in to that instance with the SA account using SQL Management Studio (latest version).

4. I have successfully added the domain account to that instance (using SQL Management studio) with sysadmin role.

5. I cannot log in to the instance using the domain account (that I added with SQL Management Studio) and integrated authentication with SQL Management Studio.

ERROR IN SQL MANAGEMENT STUDIO:

Cannot connect to 172.xxx.xxx.xxx.
Additional information:
Login failed. The login is from an untrasted domain 
and cannot be used with Integrated Authentication.
(Microsoft SQL Server, Error: 18452)

Any ideas what could be the reason or where should I look?

Problem:

Trigger send an e-mail immediately when the site is unreachable.

System:

Linux Debian Stretch, Zabbix 4.2.1.

Current configuration of the web scenario:

Scenario: 
Name: website.com 
Update interval: 30s 
Attempts: 3 
Agent: Zabbix

Steps: 
(just one) 
Name: website.com 
URL: http://website.com/page.php
Follow redirects: checked 
Timeout: 30s

(rest unchanged)

Current configuration of the trigger:

Name: The website.com can't be reached!
Expression: {VIRTUALMACHINE:web.test.fail[website.com].last(3m)}>0

(rest unchanged)

Explanation

The trigger has to send an e-mail if the site is unreachable for 3 minutes (or 3 last checks with timeout 30 seconds on every check). I was trying to do it in many ways (below*), but with each trigger expression that I tried the e-mail notification was sent immediately when the zabbix detected the problem for the first time (and not for the nth attempt).

*
{VIRTUALMACHINE:web.test.fail[website.com].sum(#3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].last(3m)}<>0
{VIRTUALMACHINE:web.test.rspcode[website.com,website.com].last(0)}#200
{VIRTUALMACHINE:web.test.fail[website.com].last(3)}#0
{VIRTUALMACHINE:web.test.fail[website.com].sum(#3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].last(3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].min(1)}>0

Please if you give an answer explain it. Feel free to ask.

I have configured HAProxy as reverse proxy - with single SharePoint site, server and it's working (SSL pass-through on IIS), but when I'm trying to configure two compeletly different SharePoint sites with different servers on the same HAProxy config, it doesn't work. I have configured two network adapters on Linux - local network and public network. On Windows I have only local network - Windows is connecting with Linux in local network and then through HAProxy I can open the SharePoint site from the internet. I was trying in a few ways to do it for multiple sites without result.

Additional info: system Linux Debian 9.5 Stretch; HAProxy 1.7.5-2

First haproxy.cfg

If I will comment out the 'second' site - then the 'first' will work and If I will comment out the 'first' - then the 'second' will work. So both sites are working separately.

global
    maxconn 4096
    spread-checks 2
    user haproxy
    group haproxy
    daemon
defaults
    mode tcp
    log 127.0.0.1 local0 notice
    maxconn 2000
    option tcplog
    option dontlognull
    timeout connect 20s
    timeout client 10m
    timeout server 10m

frontend firstfront
    mode tcp
    bind *:443
    acl hosts_firstback hdr_end(host) -i first.sharepoint-a.com
    use_backend firstback if hosts_firstback
    default_backend firstback
backend firstback
    mode tcp
    balance roundrobin
    option redispatch
    server FIRSTSERVER 111.111.111.111:443
    option ssl-hello-chk

frontend secondfront 
    mode tcp
    bind *:443
    acl hosts_secondback hdr_end(host) -i second.sharepoint-b.com
    use_backend secondback if hosts_secondback
    default_backend secondback
backend secondback
    mode tcp
    balance roundrobin
    option redispatch
    server SECONDSERVER 222.222.222.222:443
    option ssl-hello-chk

Above haproxy.cfg:

first.sharepoint-a.com - Not Found. HTTP Error 404.

second.sharepoint-b.com - Connection failed.

$ sudo systemctl status haproxy without errors.

$ sudo haproxy -c -f haproxy.cfg
Configuration file is valid

haproxy.log without errors

Second haproxy.cfg

global
    maxconn 4096
    spread-checks 2
    user haproxy
    group haproxy
    daemon
defaults
    mode tcp
    #option forwardfor
    log 127.0.0.1 local0 notice
    maxconn 2000
    option tcplog
    option dontlognull
    timeout connect 20s
    timeout client 10m
    timeout server 10m

frontend spfront
    mode tcp
    bind *:443
    use_backend firstback if { hdr(host) -i first.sharepoint-a.com }
    use_backend secondback if { hdr(host) -i second.sharepoint-b.com }

backend firstback
    mode tcp
    server FIRSTSERVER 111.111.111.111:443

backend secondback
    mode tcp
    server SECONDSERVER 222.222.222.222:443

first.sharepoint-a.com - Secure connection failed.

second.sharepoint-b.com - Connection failed.

$ sudo systemctl status haproxy without errors.

$ sudo haproxy -c -f haproxy.cfg
Configuration file is valid

haproxy.log without errors

I tried with many combinations and result is the same or similar. Please help me with the configuration file - where I made a mistakes and feel free to ask.

UPDATE BELOW

I decided to use HAProxy as reverse-proxy for SharePoint sites and without SSL everything works fine, but with SSL I can't start haproxy.service. I was trying with many configurations, but I can't figure it out...

Trying to start service:

$ sudo systemctl start haproxy.service
Job for haproxy.service failed because the control process exited with error code.
See "systemctl status haproxy.service" and "journalctl -xe" for details.

Status of the haproxy.service:

$ sudo systemctl status haproxy.service
     haproxy.service - HAProxy Load Balancer
       Loaded: loaded (/lib/systemd/system/haproxy.service; enabled; vendor preset: enabled)
       Active: failed (Result: exit-code) since date CEST;
         Docs: man:haproxy(1)
               file:/usr/share/doc/haproxy/configuration.txt.gz
      Process: ExecStart=/usr/sbin/haproxy-systemd-wrapper -f $CONFIG -p $PIDFILE $EXTRAOPTS (code=exited, status=0/SUCCESS)
      Process: ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS (code=exited, status=1/FAILURE)
     Main PID: (code=exited, status=0/SUCCESS)
 systemd[1]: haproxy.service: Failed with result 'exit-code'.
 systemd[1]: haproxy.service: Service hold-off time over, scheduling restart.
 systemd[1]: Stopped HAProxy Load Balancer.
 systemd[1]: haproxy.service: Start request repeated too quickly.
 systemd[1]: Failed to start HAProxy Load Balancer.
 systemd[1]: haproxy.service: Unit entered failed state.
 systemd[1]: haproxy.service: Failed with result 'exit-code'.
 systemd[1]: haproxy.service: Start request repeated too quickly.
 systemd[1]: Failed to start HAProxy Load Balancer.
 systemd[1]: haproxy.service: Failed with result 'exit-code'.

Checking configuration file issues:

$ sudo haproxy -c -f haproxy.cfg
    Enter PEM pass phrase:
    [ALERT]: parsing [haproxy.cfg:31] : 'bind *:443' : unable to load SSL private key from PEM file './cert.pem'.
    [ALERT]: Error(s) found in configuration file : haproxy.cfg
    [ALERT]: Proxy 'http_id': no SSL certificate specified for bind '*:443' at [haproxy.cfg:31] (use 'crt').    
    [ALERT]: Fatal errors found in configuration.

HAProxy -vv:

$ sudo haproxy -vv
HA-Proxy version 1.7.5-2

Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.8
Running on zlib version : 1.2.8
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with OpenSSL version : OpenSSL 1.1.0e
Running on OpenSSL version : OpenSSL 1.1.0f
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.39
Running on PCRE version : 8.39
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with Lua version : Lua 5.3.3
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Built with network namespace support

Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Available filters :
        [COMP] compression
        [TRACE] trace
        [SPOE] spoe

Logs:

 haproxy: [ALERT]: parsing [/etc/haproxy/haproxy.cfg:31] : 'bind *:443' : unable to load SSL certificate file './cert.pem' file does not exist.
 haproxy: [ALERT]: Error(s) found in configuration file : /etc/haproxy/.cfg
 haproxy: [ALERT]: Proxy 'http_id': no SSL certificate specified for bind '*:443' at [/etc/haproxy/haproxy.cfg:31] (use 'crt').
 haproxy: [ALERT]: Fatal errors found in configuration.

I'm using the same certificate (but divided: certificate, key, chain) for nginx on another server and It works. I created this one for HAProxy with cat cert.crt priv.key certchain.crt > cert.pem command and I tried in different orders, but error is the same. Also with command haproxy -c -f haproxy.cfg server is asking about pass phrase so I think that the certificate is okay (maybe I'm wrong) and something's wrong with the configuration file. Thank you for your time and help.

My haproxy.cfg:

    global    
        tune.ssl.default-dh-param 2048
        maxconn 4096
        user haproxy
        group haproxy
        daemon
        #ssl-server-verify none
    
    defaults
        mode http
        option forwardfor
        log 127.0.0.1 local0 notice
        maxconn 2000
        option httplog
        option dontlognull
        timeout connect 5000
        timeout client 50000
        timeout server 50000
            
    backend sharepoint
        mode http
        #balance roundrobin
        option redispatch
        cookie SERVERID insert nocache
        server spsrv xxx.xxx.xxx.xxx:80
            
    frontend http_id
        #bind *:80
        bind *:443 ssl crt ./cert.pem
        mode http
        reqadd X-Forwarded-Proto:\ https
        acl hosts_sharepoint hdr_end(host) -i intranet.sharepoint.com:443
        use_backend sharepoint if hosts_sharepoint
        default_backend sharepoint

FIRST UPDATE

I tried with pass-through and now SharePoint is asking for credentials (after disabling IIS role) on port 80 and then SharePoint is redirecting to https with error "504 Gateway Time-out". This is my current haproxy.cfg:

global
    maxconn 4096
    user haproxy
    group haproxy
    daemon
defaults
    mode tcp
    log 127.0.0.1 local0 notice
    maxconn 2000
    option tcplog
    option dontlognull
    timeout connect 20s
    timeout client 10m
    timeout server 10m
frontend httpid
    mode tcp
    bind *:443
    acl hosts_sharepoint hdr_end(host) -i intranet.sharepoint.com
    use_backend sharepoint if hosts_sharepoint
    default_backend sharepoint
backend sharepoint
    mode tcp
    balance roundrobin
    option redispatch
    cookie SERVERID insert indirect nocache
    server st1 xxx.xxx.xxx.xxx:443
    option ssl-hello-chk

Also command: $ curl xxx.xxx.xxx.xxx:**80** --header 'Host: sharepoint.intranet.com' -vv returns 401 so the connection is working, but command with port 443 $ url xxx.xxx.xxx.xxx:**443** --header 'Host: sharepoint.intranet.com' -vv returns curl: (56) Recv failure: Connection reset by peer. Is my configuration file correct? Or maybe I need to configure IIS?

SECOND UPDATE

After restart the SharePoint server this configuration is working with pass-through:

global
    maxconn 4096
    user haproxy
    group haproxy
    daemon
defaults
    mode tcp
    log 127.0.0.1 local0 notice
    maxconn 2000
    option tcplog
    option dontlognull
    timeout connect 20s
    timeout client 10m
    timeout server 10m
frontend httpid
    mode tcp
    bind *:443
    acl hosts_sharepoint hdr_end(host) -i intranet.sharepoint.com
    use_backend sharepoint if hosts_sharepoint
    default_backend sharepoint
backend sharepoint
    mode tcp
    balance roundrobin
    option redispatch
    cookie SERVERID insert indirect nocache
    server st1 xxx.xxx.xxx.xxx:443
    option ssl-hello-chk

I'm configuring Windows Network Load Balancing between two SharePoint servers which are in the same NLB cluster, but I want to have the first server for users and second for services (and for users only when the load on the first server is high, for example 80%). For now the load is the same on both servers in multiple mode.

It is possible to accomplish with Microsoft NLB? Or are there other tools for Windows? It will be a production environment.