Why do software load balancers mask the client IP?

Question

Currently I'm using a Cisco CSS hardware load balancer. From the web server's point of view, the end-user's IP address is stamped on all traffic as if the load balancer weren't even present.

I'm now looking at software replacements such as HAProxy, Pound, or AWS ELB. They all have one thing in common: the web server receives the load balancer's IP instead of the end-user's. Your system has to be aware of this and access an X-Forwarded-For header if you want the end-user's IP, or in the case of SSL, decrypt and re-encrypt the traffic.

So my question is: Why is this the case? Why can software load balancers not behave in the same way as hardware load balancers, and just pass along the TCP packets as if they were a simple networking device?

Answer 1

Because thoses softwares works on the layer 7 (Application) of the OSI Model, there is software solutions which works on the layer 3/4 like LVS.

Regarding your problem, the solution is quite simple if you are using Apache as web server, you just have to install mod_rpaf. This module permit to log directly the IP provided by the X-Forwarded-For header.

Answer 2

Ummm, the short answer is "they can", so I'm not sure the question can be answered.

I'd hazard a guess, though, that the difference between the hardware and software solutions is that the hardware box is designed to go in as a router - that is, it'll see all traffic from client to end-server, and can massage it in both directions accordingly - while the software solutions are on boxes which aren't routing, and therefore rewrite the client address as a cheap-and-cheerful way to force the return-hop traffic to go back through them for massaging.

Answer 3

Software load balancers work on a higher TCP stack layer. You should use iptables to achieve the same effect. An example can be found here.

Answer 4

They can, it's hasn't been supported by default in the kernel. It's usually referred to (I believe) as source address spoofing. If you Google "source spoofing haproxy" you get a few hits.

Most notably.

http://blog.loadbalancer.org/configure-haproxy-with-tproxy-kernel-for-full-transparent-proxy/