I have had configured transparent proxy mode in HAproxy with my configure shown below:

  maxconn 5000
  stats socket /var/run/haproxy.stat mode 600 level admin
  log local2
  tune.ssl.default-dh-param 2048
  stats bind-process 1
  nbproc 1
  user root
  group root

  mode tcp
  #option forwardfor
  #option http-server-close
  timeout http-request 30s
  timeout connect 30s
  timeout server 60s
  timeout client 60s

listen stats
  mode http
  bind-process 1
  stats enable
  stats uri     /
  stats realm   HAProxy Statistics
  stats auth    admin:admin

frontend port80
  bind-process 1
  #bind *:80 transparent
  bind transparent
  maxconn 5000
  mode tcp
  #option http-server-close
  #option forwardfor except
  default_backend backend_port80

backend backend_port80
  mode tcp
  #bind-process all
  log global
  balance roundrobin
  #option forwardfor
  source usesrc clientip
  server test1 check
  server test2 check

And here is my kernel config by sysctl -p

net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.all.send_redirects = 1
net.ipv4.ip_nonlocal_bind = 1

And here is iptables and routing

 iptables -A POSTROUTING -t nat -j MASQUERADE
 iptables -t mangle -N DIVERT
 iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
 iptables -t mangle -A DIVERT -j MARK --set-mark 1
 iptables -t mangle -A DIVERT -j ACCEPT
 ip rule add fwmark 1 lookup 100
 ip route add local dev lo table 100

I also enabled xt_TPROXY in Centos 7.

xt_TPROXY              17327  0
nf_defrag_ipv6         35104  1 xt_TPROXY
nf_defrag_ipv4         12729  1 xt_TPROXY 

My backend server is webserver by apache2.4, I couldn't see IP client in the log. I did't know why transparent proxy didn't work. I also set up my HAproxy be to backend's default-gateway but still doesn't work

  • Without knowing what "didn't work" means, we can't know either. – womble Jun 4 at 3:53
  • What do u mean? I cant see IP client, i only see IP of HAproxy server. although I enabled transparent ip client mode. – Giang Lâm Hữu Phước Jun 4 at 4:08

I think you are missing the most important line:

source usesrc clientip

i.e. tell HAProxy to replace the source IP. As described here: https://www.loadbalancer.org/blog/configure-haproxy-with-tproxy-kernel-for-full-transparent-proxy/

  • I added source usesrc clientip in backend backend_port80 in my haproxy.cnf – Giang Lâm Hữu Phước Jun 4 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.