Yesterday we got hit by a DDoS attack reaching our webserver backends (apache2). The frontend consists of haproxy loadbalancing connections to the webservers. On access.log of apache we saw thousands of requests from two ips and after a couple of hours we realized that those were fake/spoofed and were not the actual ips.
For clarification reasons, we did a "curl GET /" with an ip of "22.214.171.124" and indeed that's the ip (fake one) we saw in our weblogs
Now, in another cluster where we use nginx as reverse proxy, changing/crafting the X-Forwarded-For Header doesn't work. Meaning , even if you enter a random ip in the specific header nginx will still pass the correct ip to the backend webserver?
Does this has to do with haproxy?
Anyone can confirm that crafted X-Forwarded-For headers can pass through haproxy?
Why is this not happening in nginx ?
How do you prevent this?