We're using HAProxy to proxy SSL Traffic (without SSL termination, so mode tcp.)

The problem with mode tcp is that HAProxy can't put the client-ip (the one that content is being proxied to) in the forwarded for request headers, which means that we lose client ip in our backend logs.

Is it possible to configure HAProxy to log:

  • the client ip
  • the outbound (ephemeral) port its connecting to the backend on
  • the backend ip/name and port its connecting to

This way we can log the "client" ip + port in our backend and correlate the two logs.

Or is there any other way to solve this, besides recompiling HAProxy with TProxy enabled?

  • What are the backends? – GregL Feb 12 '16 at 12:27
  • @GregL not sure what you mean? The backends are java jetty servers with https bindings, is that what you're looking for? – Cipher Feb 12 '16 at 18:54
  • Yes. I was asking because HAProxy supports the [PROXY protocol[(blog.haproxy.com/haproxy/proxy-protocol), which could pass that information to your backends. As best I can tell, Jetty doesn't support it, so it's not an option. – GregL Feb 12 '16 at 19:09
  • That said, section 8.2.4 of the HAProxy docs outlines the possible fields that you can log, and it looks like there's a bunch that might work: client_ip, backend_source_ip, backend_source_port, server_ip, server_port. – GregL Feb 12 '16 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.