On HAProxy instances running on K8S I need to block certain IP addresses manually on HAProxy. Currently I am failing already to log them. Per the AWS docs the loadbalancers set the X-Forwarded-For
request header and fill in the clients IP address.
When trying to log this header (and hence the clients IP), I always get empty strings with HAProxy version 2.0.18 and 2.2.20. So I guess, I misconfigured HAProxy. My config looks like:
global
daemon
maxconn 256
log stdout format raw local0
defaults
mode http
option httplog
option dontlognull
timeout connect 15000ms
timeout client 150000ms
timeout server 150000ms
userlist global_auth
user someuser insecure-password somepass
frontend http-in
bind *:80
bind *:443 ssl crt /etc/certs/myapp-de.pem/cert_bundle_key.pem alpn h2,http/1.1
option httplog
option dontlognull
capture request header X-Forwarded-For len 500
capture request header x-forwarded-for len 500
log-format "Headers = --%hr--, --%hrl-- | Headers2: --%[capture.req.hdr(0)]--, --%[capture.req.hdr(1)]--"
log global
acl host_ssl_exception hdr(host) -i jobs.myapp.com
redirect scheme https code 301 if !{ ssl_fc } !host_ssl_exception
acl is_post method POST|OPTIONS
acl is_get method GET
default_backend myapp-web
backend myapp-web
mode http
compression algo gzip
compression type text/html text/plain text/css application/javascript application/json
server web1 myapp-web.myapp-${TRACK}.svc.cluster.local:80 maxconn 32 cookie check
All but one backend removed. HTTPS and HTTP2 enabled. The capture
seems to fail, but currently I do not get why.