HAProxy: forward client ip (ssl traffic) to the backend

Question

If I send SSL traffic to the backend server, I can see the client/source IP in the application logs.

ssl://host_name:8883

Problem: If I place haproxy before the backend server, I get haproxy IP as the source IP. SSL termination happens at the backend server.

haproxy.cfg:

defaults
    maxconn 64000
    option http-server-close
    option httplog
    option forwardfor
    option contstats
    timeout connect         5000ms
    timeout client          30000ms
    timeout server          30000ms
    timeout tunnel          3600000ms
    timeout http-keep-alive 1000ms
    timeout http-request    30000ms
    timeout queue           30000ms
    errorfile 504 /var/504.http

frontend tcp-frontend-mqtt-tls
    mode tcp
    bind :8883 accept-proxy
    log global
    log-format %ci\ %fi:%fp\ [%t]\ %ft\ %b/%s\ %Tw/%Tc/%Tt\ %B\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq
    tcp-request connection reject if { src -f /var/ip_blist.lst }
    default_backend tcp-backend-mqtt-tls

backend tcp-backend-mqtt-tls
    mode tcp
    log global
    balance leastconn
    source 0.0.0.0 usesrc clientip
    server mqtt-node-0 hostname:61008 resolvers my-dns check inter 1000

I've tried adding send-proxyv-v2 and send-proxy

server mqtt-node-0 hostname:61008 resolvers my-dns check inter 1000 send-proxy-v2
server mqtt-node-0 hostname:61008 resolvers my-dns check inter 1000 send-proxy

but that doesn't help as the SSL termination happens on the backend. am I missing something?

dcorbett dcorbett · Accepted Answer · 2020-09-09T21:14:14

send-proxy is a good way to do it but your backend server/application needs to be able to parse the PROXY protocol to receive the IP information.

HAProxy: forward client ip (ssl traffic) to the backend

1 Answers