CODEWITHSUNDEEP
sslhaproxy
mmikess
mmikess

Reputation: 3

HAProxy - SSL SNI inconvenience

I found some inconvenience in haproxy 1.5 when i try to configure SSL SNI.

There is a fragment of haproxy configuration: pastebin

I would like to pass client IP to backend. No matter how I configure reqadd / set-header X-Forwarded-For / Real-IP I always got a haproxy IP address in X-Forwarded-For.

Someone try to pass real IP with SSL SNI on HAProxy ? :/

Upvotes: 0

Views: 763

Answers (1)

Michael - sqlbot
Michael - sqlbot

Reputation: 179404

From this configuration, you seem to be doing SNI-sniffing, yet all of the backends are looping back to HAProxy itself... which is not a case where SNI-sniffing is required. Perhaps I'm overlooking something else that would require this.

It should be apparent why you are getting the proxy's IP in X-Forwarded-For -- HAProxy is talking to itself. The first pass through the proxy is the client connection, as far as the proxy can determine on the second pass, because only the second pass is speaking HTTP. It only sees that an incoming TCP connection has arrived... from itself.

The solution is for the first-pass backend to pass the original client information using the Proxy Protocol and the second-pass frontend to decode it.

Add accept-proxy to the bind lines for the second-pass frontends, and add send-proxy to the server lines on the first-pass backends. This way, on the connection where HAProxy is talking to itself, the first-pass backend will send the Proxy protocol preamble and the second-pass frontend will decode the incoming value and place it in X-Forwarded-For.

Upvotes: 1

Related Questions