Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a haproxy set for https and as such I had to enable mode:tcp for that but as it turns out becasue of that forwardfor is being ignored and I can't see original ip. is there any way to bypass it?

haproxy ver: 1.4.9

cheers, /Marcin

share|improve this question
up vote 2 down vote accepted

x-forwarded-for is an HTTP header field, so has nothing to do with the transport layer (TCP). Usually web proxies insert the x-forwarded-for data.

If you want to have the source IP when balancing at transport layer, then you need to compile haproxy with TPROXY support. See:

But note that the current Linux kernel has TPROXY support by default (It has done since 2.6.28), so you may be able to skip the kernel step described in the above blog post if your kernel version > 2.6.28.

share|improve this answer
yeah, the example there is for port 80 - mode http so that is no problem, the problem is mode tcp and forwardfor, but thanks – Marcin Apr 21 '11 at 14:22
Actually I think that is an error in the config file. It should be mode tcp. The point is, you need TCP transparency, which you won't get with 'option forwardfor' because this is operating on HTTP headers only. TPROXY is your only option and then you need this line: source usesrc clientip. – James Little Apr 21 '11 at 14:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.