I've followed numerous references online, which tell me I should just be able to set up a frontend like:

frontend http_https
  bind ssl crt /etc/haproxy/tls/mycert.pem
  mode http
  option httplog
  option forwardfor
  option http-server-close
  redirect scheme https code 301 if !{ ssl_fc }
  http-request set-header X-Forwarded-Port %[dst_port]
  http-request add-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Request-Start t=%Ts%ms
  http-response set-header Strict-Transport-Security max-age=15768000
  use_backend %[req.hdr(host),lower,map(/etc/haproxy/domains-to-backends.map)]

When I take a tcpdump on my backend server, I see all the add-header and set-header headers, but I don't see any X-Forwarded-For header.

If I add something like:

  http-request add-header X-Client-IP %[src]

I do see that header passed along, with the correct client IP.

Can anyone offer any insight into why this may not be working? Or any reason I shouldn't just use http-request set-header X-Forwarded-For %[src] instead of option forwardfor?

A sample backend section:

backend bk_foo
  balance roundrobin
  errorfile 502 /etc/haproxy/errorfiles/502.http
  errorfile 503 /etc/haproxy/errorfiles/503.http
  errorfile 504 /etc/haproxy/errorfiles/504.http
  option httpchk
  server foo.example.com check
  • FWIW, I'm using HAProxy 1.5.14 on CentOS 7.
    – pioto
    Sep 12, 2016 at 20:02

1 Answer 1


edit: You should be putting option forwardfor in the backend section. Not under frontend section.

I don't think there is anything wrong with the HAProxy config. I have done many configurations with forwardfor option without any issue. Any chance there is a device sitting between HAProxy and backend server that might be removing certain headers? Also I would suggest to test with a simple setup focusing on this header to ensure other configurations does not cause the issue.

  • No, there's nothing between HAProxy and the backend that would be removing headers. Simply adding http-request set-header X-Forwarded-For %[src] instead of option forwardfor has the desired effect. Is there possibly some weird interaction with the other http-request statements or something?
    – pioto
    Sep 27, 2016 at 19:46
  • Have you tested with simple config to that only includes option forwardfor ?
    – antimatter
    Sep 30, 2016 at 11:13
  • I haven't yet built a simpler config to test it. Interesting you say it needs to be in the backend section, because the documentation says it works in the frontend? cbonte.github.io/haproxy-dconv/1.5/…
    – pioto
    Sep 30, 2016 at 14:39
  • Yeah, it seems either way should work based on documentation. But normally I put it under backend. What does your backend section looks like?
    – antimatter
    Sep 30, 2016 at 14:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .