Alright so I have a server box with HAProxy installed and I need it to forward traffic to two MySQL servers. They are both located in completely different datacenters. It works when I have this removed from the config: source usesrc clientip However, when enabled I can't get a response from the MySQL servers.

I have these IPTables rules on the HAProxy server: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 111 iptables -t mangle -A DIVERT -j ACCEPT ip rule add dev eth0 fwmark 111 lookup 100 ip route add local dev lo table 100

And no connection can be made. However, when I add this: iptables -A POSTROUTING -t nat -j MASQUERADE

It works but the client IP is not being sent, just the proxy IP.

The MySQL servers are configured to have the HAProxy server's ip as their default gateway.

I'm not sure if this is even possible, I've been messing with this for days.

My HAProxy config:

    log local0 debug

    log global
    retries 2
    #option dontlognull
    option tcp-smart-accept
    option tcp-smart-connect
    option tcplog
    option log-health-checks
    timeout connect 3000
    timeout server 5000
    timeout client 5000

frontend mysql-frontend
    bind transparent
    default_backend mysql-backend

backend mysql-backend
    mode tcp
    source usesrc clientip
    option mysql-check user haproxy_check
    server mysql1 check
    server mysql2 check

Route tables for one of the MySQL servers:

Destination Gateway Genmask Flags Metric Ref Use Iface UG 2 0 0 eth0 UH 2 0 0 eth0 U 0 0 0 eth0 U 0 0 0 lo

Sysctl for the HAProxy box:

net.ipv4.ip_forward = 1 net.ipv4.conf.all.forwarding = 1 net.ipv4.conf.all.accept_redirects = 1 net.ipv4.conf.all.send_redirects = 1 net.ipv4.conf.eth0.send_redirects = 1 net.ipv4.ip_nonlocal_bind = 1 net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.default.accept_source_route = 0

The TProxy module is also compiled into HAProxy, and the required kernel modules are enabled as well.

There is also only one interface, eth0.

Please let me know what I'm doing wrong, or if this is even possible!



Transparent mode requires that the haproxy be the default gateway of the backend servers. Remote servers won't work.

  • Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP. – Rhododendron Jul 8 '16 at 17:50
  • You don't. Pick a different solution. – longneck Jul 8 '16 at 17:52
  • What available solutions are there that can get me the origin IP in this instance? I can't find anything. – Rhododendron Jul 8 '16 at 17:53
  • With remote servers and the origin IP on the packet? None. – longneck Jul 8 '16 at 17:54
  • 1
    This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best. – longneck Jul 8 '16 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.