2

Currently I'm using a Cisco CSS hardware load balancer. From the web server's point of view, the end-user's IP address is stamped on all traffic as if the load balancer weren't even present.

I'm now looking at software replacements such as HAProxy, Pound, or AWS ELB. They all have one thing in common: the web server receives the load balancer's IP instead of the end-user's. Your system has to be aware of this and access an X-Forwarded-For header if you want the end-user's IP, or in the case of SSL, decrypt and re-encrypt the traffic.

So my question is: Why is this the case? Why can software load balancers not behave in the same way as hardware load balancers, and just pass along the TCP packets as if they were a simple networking device?

|improve this question
  • I'd imagine one reason is the web servers should really be firewalled to only accept traffic from those load balancers. – ceejayoz Aug 23 '12 at 15:07
4

Because thoses softwares works on the layer 7 (Application) of the OSI Model, there is software solutions which works on the layer 3/4 like LVS.

Regarding your problem, the solution is quite simple if you are using Apache as web server, you just have to install mod_rpaf. This module permit to log directly the IP provided by the X-Forwarded-For header.

|improve this answer
1

Ummm, the short answer is "they can", so I'm not sure the question can be answered.

I'd hazard a guess, though, that the difference between the hardware and software solutions is that the hardware box is designed to go in as a router - that is, it'll see all traffic from client to end-server, and can massage it in both directions accordingly - while the software solutions are on boxes which aren't routing, and therefore rewrite the client address as a cheap-and-cheerful way to force the return-hop traffic to go back through them for massaging.

|improve this answer
1

Software load balancers work on a higher TCP stack layer. You should use iptables to achieve the same effect. An example can be found here.

|improve this answer
1

They can, it's hasn't been supported by default in the kernel. It's usually referred to (I believe) as source address spoofing. If you Google "source spoofing haproxy" you get a few hits.

Most notably.

http://blog.loadbalancer.org/configure-haproxy-with-tproxy-kernel-for-full-transparent-proxy/

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.