Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my HAProxy load balancer, I have the following config chunks:

defaults
    mode                    http
    log                     global
    option                  httplog clf
    option                  dontlognull
    option http-server-close
    option forwardfor       except 127.0.0.0/8
    option                  redispatch

frontend  main_http *:80
    option forwardfor except 127.0.0.1
    option httpclose
    default_backend         backend_http

backend backend_http
    balance     roundrobin
    option httpchk
    server  node1 10.0.0.64:80 check port 80
    server  node2 10.0.0.65:80 check port 80
    server  node3 10.0.0.66:80 check port 80

On the nodes (Tomcat), I'm logging requests in this format (combined with x-forwarded-for in the first field and the real REMOTE_ADDR tacked onto the end):

pattern='%{X-Forwarded-For}i - %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i" %a'

This seems to work well for most requests, but in some cases, I assume in which the clients are behind proxies themselves, I'm seeing requests where the first field contains these values (each line represents one real request, I mangled the real IPs for privacy):

10.83.103.44, 10.83.103.44 
10.83.198.52, 10.83.198.52 
10.53.109.36, 10.53.109.36 
unknown, unknown 
192.168.1.43, 127.0.0.1 
192.168.11.189, 127.0.0.1 
10.1.6.3, 216.x.y.194, 10.37.52.202 
192.168.50.250, 38.x.y.5, 10.37.31.201 

According to the HAproxy docs, the last X-Forwarded-For should be the correct one that it appended, but this doesn't appear to be the case. My application uses the client IP for a geo lookup, so this isn't just a logging issue, it's actually screwing things up.

What I'd like to do is: instead of having HAproxy append the client's IP to the existing X-Forwarded-For header it receives, simply overwrite it. So if it receives X-Forwarded-For: 10.1.2.3 from IP addres 98.76.54.32, what it would send to the clients is just X-Forwarded-For: 98.76.54.32. Is there any way to do this? I'd like to know why such obvious junk is making it to the nodes - unknown, unknown is clearly junk info - but I'll settle for a workaround if one exists.

Thanks in advance.

share|improve this question

2 Answers 2

up vote 10 down vote accepted

Tear it off the request header, before HAProxy adds its own:

reqidel ^X-Forwarded-For:.*

The risk to this change is that you'll lose your information about the "real" client IP address - your logs will then be showing the IP of the proxy server that the client is using. Sounds like you're ok with that!

As an aside, see this question for some interesting info on confusion over the append order of the X-Forwarded-For header.

share|improve this answer
    
Brilliant. I don't know why I didn't think of simply deleting the existing header. I'll give that a try - thanks! –  Evan Feb 10 '12 at 22:13
    
Worked beautifully. I'd upvote your answer but guess I can't as a newbie. –  Evan Feb 11 '12 at 21:58
    
@Evan There's an outlined checkmark under the up/down vote arrows that marks the answer as accepted - it awards some rep as well as marking it as having resolved the issue for anyone who finds this question in the future while searching. –  Shane Madden Feb 11 '12 at 22:22

If you look at haproxy documentation specifically at forwardedfor option, you can read:

option forwardfor [ except <network> ] [ header <name> ] [ if-none ]

You can change the corresponding line in your config something else like:

option forwardfor except 127.0.0.1 header My-X-Forwarded-For

This way you will end up by having two X-Forwarded-For headers. It may be useful for you to keep the clients real IPs and at the same time, you get haproxy inserting its header without confusion.

This is just another option you may be interested in :)

share|improve this answer
    
Yeah, I had considered that but it would require code changes in the app to have it read a different header, and I'd like not to do that if possible. Thanks though. –  Evan Feb 11 '12 at 21:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.