Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a temporary haproxy instance to help test a new back-end for an iphone app. Instead of having a specially produced app or a jailbreak, my plan is to set up a proxy that all phone data will go through, but have it match host headers and forward them to the new servers that are not yet live. In short, I want haproxy to act like an open proxy, apart from on some specific host names. Matching the host names and forwarding them is working perfectly, but I can't seem to make the open proxy bit work. I'm using a stock haproxy 1.4.18 package on Ubuntu Precise with stock global settings, plus these proxy settings:

frontend myapp
    default_backend passthrough
    acl mydomain hdr_end(Host)
    use_backend front if mydomain

backend front
    server front

backend passthrough
    server ???

So the frontend sits on port 8080, defaulting to pushing requests to the passthrough backend. Prior to doing that it checks the acl to see if the request is for a hostname in my domain, and if it is, forwards it to the local app instead.

The problem is with that passthrough backend. I want it to pass on requests directly to the requested host, not to a local end point. The config I've put there won't work, but I don't know what it should say. For example if I do a request for, it wouldn't match my ACL, so I'd want it forwarded directly to serverfault, not to a local server. I'm not sure what directive will do this in a backend, or whether there is some frontend directive that will do it. It's more or less a no-op as far as the proxy is concerned.

(Yes I know that open proxies are bad; this is a temporary testing configuration, running interactively for only a few minutes at a time)

Update: I've found option http_proxy does exactly what I need, apart from that it doesn't do DNS lookups, only explicit IPs, so a backend like this is nearly there:

backend passthrough
    option http_proxy
    option httpclose

I know I probably could use something else, but I just happen to really like haproxy!

share|improve this question
You could do it with a normal forwarding proxy like squid. Then have the special rules for what you want to intercept – Matt Feb 11 '13 at 15:36
up vote 0 down vote accepted

There is no way to configure haproxy to do this for you. The backend servers in haproxy have to be explicitly named.

Couldn't you instead just use a dedicated DNS server to direct the phone to the correct server?

share|improve this answer
This isn't true: you can have a backend containing only option http_proxy and no server directives and it will work. The only downside is that it won't do name lookups, only explicit IPs, making it useless as a forward proxy. – Synchro Feb 11 '13 at 16:28
I assumed that you needed to do name resolution so I didn't mention that option. – longneck Feb 11 '13 at 16:38
I gave up trying to get haproxy to do this, followed your suggestion and have set up a DNS server with dnsmasq instead, and it works just fine with a 1-line config. I did look at squid, but it's a config nightmare. – Synchro Feb 11 '13 at 18:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.