I want to forward real client's ip address from haproxy to my backend servers in tcp mode. The configuration of Haproxy is as follows:

frontend main
    bind *:80
    mode http
    option forwardfor
    option http-server-close    
    default_backend app-main

frontend https_main
    bind *:443
    mode tcp
    option tcplog
    option tcpka
    default_backend app-ssl

backend app-main
    balance roundrobin
    server web1 check fall 3 rise 2
    server web2 check fall 3 rise 2

backend app-ssl
    balance roundrobin
    mode tcp
    option ssl-hello-chk
    server web3

backend servers for http requests are apache and I have replaced the following line in httpd.conf with log lines, so I can now get the client's ip addreses correctly:

LogFormat "%h %l %u %t \"%r\" %>s %b %{X-Forwarded-For}i" common

My backend server for https uses Nginx as a reverse_proxy for ssl termination and sends the requests to apache backends. My problem is that I don't know how can I get the real client's ip address in nginx logs? I googled a lot and found some solution on serverfault and stackoverflow, but none of them resolved my problem in forwarding client's ip address in tcp mode in haproxy. Any help is appreciated.

2 Answers 2


You should use listen 443 ssl proxy_protocol; on nginx side and send_proxy directive on Haproxy side.

Using Proxy Protocol with Nginx

Haproxy documentation

Send PROXY protocol header from HAProxy

  • If the backend server is a standard Jetty server with SSL enabled instead of NGinx, how does the picture change? Do I need to do a any particular configuration on the Java side? Feb 17, 2018 at 19:41
  • You should configure PROXY protocol support on backend anyway. In case of Jetty there is ProxyConnectionFactory for that: eclipse.org/jetty/documentation/9.4.x/… Feb 18, 2018 at 6:49
  • 1
    Isn't the proxy protocol an attack vector? It looks like a plain unencrypted header that could be intercepted and modified. Any comments? Feb 26, 2018 at 16:54

My working configuration HA side:

# USED FOR some_service
frontend  some_service_https
  mode tcp
  bind *:443
  option tcplog
  option forwardfor
  default_backend some_service_https

backend some_service_https
  balance roundrobin
  stick-table type ip size 1m expire 1h
  stick on src
  server some_service send-proxy check

And NGINX side:

set_real_ip_from; # HAproxy local IP
set_real_ip_from; # HAproxy external IP
real_ip_header proxy_protocol; # proxy_protocol needed
real_ip_recursive on;

upstream some_service {
  server unix:/tmp/unicorn.some_service.sock fail_timeout=0;

server {
  server_name some_service.myserver.com some_service_1.myserver.com;
  listen 443 proxy_protocol; # proxy_protocol needed
  root /opt/apps/some_service/current/public;
  add_header X-Whom some_service_1.myserver.com;

Don't forget to add "send-proxy" on HA backend and real_ip_header proxy_protocol and listen proxy_protocol to NGINX. Works even you use 80 or 443 port or both.

  • 1
    option forwardfor won't do anything in TCP mode. Apr 4, 2020 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.