Yesterday we got hit by a DDoS attack reaching our webserver backends (apache2). The frontend consists of haproxy loadbalancing connections to the webservers. On access.log of apache we saw thousands of requests from two ips and after a couple of hours we realized that those were fake/spoofed and were not the actual ips.

For clarification reasons, we did a "curl GET /" with an ip of "" and indeed that's the ip (fake one) we saw in our weblogs

Now, in another cluster where we use nginx as reverse proxy, changing/crafting the X-Forwarded-For Header doesn't work. Meaning , even if you enter a random ip in the specific header nginx will still pass the correct ip to the backend webserver?

Does this has to do with haproxy?
Anyone can confirm that crafted X-Forwarded-For headers can pass through haproxy?
Why is this not happening in nginx ?
How do you prevent this?

  • 1
    please share your haproxy configuration – c4f4t0r Aug 12 '17 at 23:49

In haproxy, if you don't have nothing to prevent this, that is normal, I don't know ngnix, but I solved in this way with haproxy:

in defaults options:


In my haproxy frontend definition, I have:

reqidel ^X-Forwarded-For:.*

That delete X-Forwarded-For in the http request if the client try to fake and haproxy return the real header in the http response with true ip address

If you want to use X-Forwarded-For to check the ip address of http clients, you need to delete it if exists in the http request, because client that use an http proxy sometime set local ip address in X-Forwarded-For

  • you just saved the day mate – giomanda Aug 13 '17 at 10:14
  • I'm not really sure that I understand this answer. Could somebody elaborate? If you delete the X-Forwarded-For header, how can you get the client's IP address? – Wayne Sep 7 '18 at 19:33
  • 1
    It's OK. I figured out what you're saying. Sorry, was confused. Basically, this config tells haproxy to delete the IP address from the header and insert the actual one. – Wayne Sep 7 '18 at 19:42
  • @Wayne reqidel delete X-Forwarded-For if is already set in the http request – c4f4t0r Sep 9 '18 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.