Search code examples
linuxnetwork-programminghaproxy

HAProxy tcp mode source client ip

I have the following setup in HAProxy

global
    log /dev/log    local0
    log /dev/log    local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    log global
    retries 2
    option  dontlognull
    timeout connect 10000
    timeout server 600000
    timeout client 600000

frontend https
    bind 5.x.x.x:443
    default_backend https

backend https
    mode tcp
    balance roundrobin
    option tcp-check
    server traefik 192.168.128.5:9443 check fall 3 rise 2

And it works as expected, the backend server "traefik" is doing the SSL termination of the requests.

The thing is the client source IP I get in the backend server is the HAProxy's IP and I would like to pass the source IP to the backend server.

Is it possible at all? because I tried all the options I saw in internet.

Thanks.

Solution

  • At the end the solution was to use https://www.haproxy.com/blog/haproxy/proxy-protocol/ as it is supported by HAProxy and traefik.

    global
    log /dev/log    local0
    log /dev/log    local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    log global
    retries 2
    option  dontlognull
    timeout connect 10000
    timeout server 600000
    timeout client 600000

frontend https
    bind 5.x.x.x:443
    default_backend https

backend https
    mode tcp
    balance roundrobin
    option tcp-check
    server traefik 192.168.128.5:9443 check fall 3 rise 2 send-proxy

    And enabling traefik's entrypoint Proxy Protocol as described here: https://docs.traefik.io/configuration/entrypoints/#proxyprotocol