Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use following configuration to load balance https connections, using haproxy 1.4.8. SSL offloading is done by apache.

listen ssl_to_waf
    mode tcp
    balance roundrobin
    option ssl-hello-chk
    server wafA check

listen ssl_from_waf
    balance roundrobin
    option forwardfor
    server webA check

For HTTP requests this works great, requests are distributed to my Apache servers just fine. But for HTTPS request, I lose the "forwardfor" information. I need to save the client IP address. How can I use HAproxy to load balance across a number of SSL servers, allowing those servers to know the client's IP address?

share|improve this question

Short answer: You can't.

HAProxy doesn't understand SSL and hence balances these connections in TCP mode. The forwardfor option doesn't mean anything in TCP mode as it is an HTTP header.

Everything I have read about SSL and HAProxy recommends using some other software in front of HAProxy to handle the SSL offloading. Some of the suggestions were Pound and nginx however the valid point was raised that these are load-balancing proxy servers themselves and why would you introduce extra complexity and an extra hop when you could just have one of them handle the load-balancing and remove HAProxy entirely?

share|improve this answer

Upgrade to haproxy 1.5-dev12 and enable SSL offloading. Then the backend servers get an HTTP connection even when the client is using SSL. And since haproxy gets to see inside the SSL sessions it can add the forwardfor header.

share|improve this answer

I would never suggest using dev software in production environments. I use nginx for ssl in front of ha proxy on the same machines. Works like a charm even under heavy loads. Your apache servers will get http traffic. You need to send the x-forwarded-for header to apache, then install the mod-rpaf module so apache can see the client ip. You may also need to set an apache env var so apps will know that the connection was in ssl.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.