Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there something like Apache "deny from ip" in haproxy?

share|improve this question
up vote 19 down vote accepted

You can drop an IP at the tcp level by creating an ACL and then using connection reject if the ACL is matched:

    acl bad_ip src
    tcp-request connection reject if bad_ip

You could also set up a 403 backend and send them to that if you want to do it at the HTTP level:

frontend foo
        acl bad_ip src
        use_backend bad_guy if bad_ip

backend bad_guy
        mode http
        errorfile 403 /etc/haproxy/errors/403.http

These ACLs can be pretty flexible, and you can make it so multiple conditions within an ACL, or multiple ACLs within the action have to be met. More at .

share|improve this answer
You only need a separate backend if you want to use a custom 403 error page. Otherwise, you can get away with "http-request deny if bad_ip" – sh-beta Aug 31 '11 at 16:15
Do you know of way to read the ips from a more flexible store, like db or seperate flat file? – UpTheCreek Mar 30 '13 at 15:03
That backend bad_guy doesn't work as expected, since it has no defined servers, it is considered "down" and will always return 503 - service not available. I just fould you can just write "block if bad_ip" to frontend configuration and it will throw 403 page properly. EDIT: http-request deny if bad_ip works as advertised by @sh-beta - essentially does the same thing, but maybe just for http requests? – Dalibor Filus Jul 25 '13 at 14:20
There is another slight difference between block and http-request deny and that's this: "a 'block' rule placed after a 'use_backend' rule will still be processed before." – Dalibor Filus Jul 25 '13 at 14:25
If you give a "bad" guy a 403 then he knows that he is blocked and will look for another Vector. If you give a "bad" guy a 503 ..hen he thinks he successfully caused a DOS and stops the attack.. Course he may figure it out but it will take him a lot longer. – user195119 Oct 16 '13 at 5:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.