Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got haproxy set up with keepalived for load balancing and ip failover of a percona cluster, and since it works great I'd like to use the same lb / failover for another service/daemon.

I've configured haproxy this way:

listen my_service
    mode tcp
    balance leastconn
    option tcpka
    contimeout      500000
    clitimeout      500000
    srvtimeout      500000

    server host1 xxx.xxx.xxx.xx1:4567 check port 4567 inter 5000 rise 3 fall 3
    server host2 xxx.xxx.xxx.xx2:4567 check port 4567 inter 5000 rise 3 fall 3

The load balancing works fine, but the service sees the IP of the load balancer instead of the actual IPs of the clients. In http mode it's quite easy to have haproxy pass along the remote IP, but how do I do in tcp mode? This is critical due to the nature of the service I need to load balance.

Thanks! Vito

share|improve this question

2 Answers 2

There is apparently some sort of "transparent" mode for haproxy that I've never looked at or want anything to do with, that you could try. Otherwise, you'll need to teach whatever the backend service is about haproxy's special way of sending the original IP ("PROXY blahblah") and have the service pull the original IP out of that.

Why are you bothering with haproxy, though? You've got keepalived already in place, and it does proper transparent load balancing, too.

share|improve this answer
Hi, thanks a lot for your reply :) I am reading some stuff about 'tproxy' support, I guess this is what you meant? Also, I hadn't considered load balancing with keepalived directly for this. Does keepalived pass the original IP of the client? –  Vito Botta Jul 9 '12 at 15:05
Yes, keepalived keeps the original IP intact, because it's a load balancer, not a proxy. –  womble Jul 9 '12 at 15:08

Just for future references, keepalived is a solution for failover not load balancing (maybe you mean LVS?). the transparent proxy mode for HAProxy has nothing to do with any special way of sending the original IP, that would be the normal non-transparent HTTP mode where you can use a standardized HTTP header for this.

In my opinion the correctly answer the original question is: You could compile transparent proxy support in HAProxy on a TPROXY enabled linux kernel. This together with proper TPROXY supporting version + configuration of iptables on the same machine enables actual fully transparent tcp proxy support. This means that backend servers do NOT need any special configuration.

Note that this is actually not the recommended setup for HAProxy and should only be used if you absolutely need it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.