0

We are in the process of setting up two IIS servers that will be load balanced behind a server running HAProxy.

All traffic to these servers will be over HTTPS.

The problem that we are noticing is that all traffic is being logged on the IIS servers as coming from the HAProxy server IP. While this is technically correct, I'm trying to figure out how we can "see" the original client IP address on the IIS servers for logging purposes.

We have X-Forwarded-For setup on both the HAProxy and IIS (by installing F5′s X-Forwarded-For ISAPI filter), however this only appears to help with traffic over HTTP. HTTPS is still being logged as coming from the HAProxy server.

Thanks for any help!

Improve this question

3 Answers 3

Reset to default
1

That is a "normal" side-affect of proxies. You should have corresponding logs on the proxy that matches up.

Improve this answer
2
  • The problem is that the web servers that are being proxied have security measures in place to prevent brute force attacks. After 10 invalid login attempts within 5 minutes the IP address is locked out for 30 minutes. Without the correct client IP address all users will be locked out since they everyone appears to come from the same IP address.
    – Richard West
    Jun 15, 2011 at 13:20
  • Then you might try to look into whether the proxy can run in "transparent" mode, preserve connecting IP information or if the web servers can determine lockout based on cookies instead of IP information.
    – user48838
    Jun 15, 2011 at 18:17
0

It sounds like you have the correct solution for HTTP. I would check with HAProxy to make sure that it's offloading SSL properly. If it passes the request through untouched that it doesn't have the ability to add the X-Forwarded-For header. But if you offload it, then it should send the request from HAProxy as HTTP (make sure that it's a trusted switched network). Then it can add the necessary HTTP headers, including some SSL HTTP headers.

Improve this answer
2
  • Thanks for the feedback Scott. The problem is that this will potentially be hosted with a cloud provider. Therefore I cannot trust the network behind the proxy and eveything must remain encrypted at all times.
    – Richard West
    Jun 15, 2011 at 13:26
  • Hi Richard. I haven't worked with HAProxy so I'm not sure what is supported, but it sounds like it's trying to pass the request through untouched. If it does that, then it can't inject the headers. What you need is for it to decrypt the conversation, inject the headers, then encrypt it again. Microsoft's ARR solution does that and is an alternative to HAProxy. You can either take it for a spin, or at least learn from the concept by seeing if there is a setting in HAProxy to handle this situation.
    – Scott Forsyth
    Jun 21, 2011 at 13:28
0

Further to Scott's note (I can't comment yet, sorry), can the HAProxy not re-encrypt the connection after it's offloaded the SSL? We're using ARR with it putting the original client IP in the X-Forwarded-For after offloading, then it's sending it on as SSL again. We then use the ARR Helper tool to put the X-Forwarded-For back into the client IP so it shows up nicely in the logs.

So basically, we're SSL the entire connection between client and web server except we're decrypting, inserting the client IP, and encrypting as it passes through ARR. So the question is, can HAProxy do the same thing?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .