Alright so I have a server box with HAProxy installed and I need it to forward traffic to two MySQL servers. They are both located in completely different datacenters. It works when I have this removed from the config:
source 0.0.0.0 usesrc clientip
However, when enabled I can't get a response from the MySQL servers.
I have these IPTables rules on the HAProxy server:
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 111
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add dev eth0 fwmark 111 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
And no connection can be made. However, when I add this:
iptables -A POSTROUTING -t nat -j MASQUERADE
It works but the client IP is not being sent, just the proxy IP.
The MySQL servers are configured to have the HAProxy server's ip as their default gateway.
I'm not sure if this is even possible, I've been messing with this for days.
My HAProxy config:
global log 127.0.0.1 local0 debug daemon defaults log global retries 2 #option dontlognull option tcp-smart-accept option tcp-smart-connect option tcplog option log-health-checks timeout connect 3000 timeout server 5000 timeout client 5000 frontend mysql-frontend bind 100.111.111.111:3306 transparent default_backend mysql-backend backend mysql-backend mode tcp source 0.0.0.0 usesrc clientip option mysql-check user haproxy_check server mysql1 188.8.131.52:3306 check server mysql2 184.108.40.206:3306 check
Route tables for one of the MySQL servers:
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 100.111.111.111 0.0.0.0 UG 2 0 0 eth0
100.111.111.111 0.0.0.0 255.255.255.255 UH 2 0 0 eth0
220.127.116.11 0.0.0.0 255.255.255.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
Sysctl for the HAProxy box:
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.all.send_redirects = 1
net.ipv4.conf.eth0.send_redirects = 1
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.default.accept_source_route = 0
The TProxy module is also compiled into HAProxy, and the required kernel modules are enabled as well.
There is also only one interface, eth0.
Please let me know what I'm doing wrong, or if this is even possible!