I am trying to create an environment using HAProxy to allow websites hosted on a local servers (having a private IP) be accessed through SSL connection using HAProxy Server (having a public IP and local private IP). I do not want HAProxy server to manage SSL certificate for its backend servers, instead backend servers (ie local private servers) manage the certificates themself and HAProxy just use backend server's certificate to create connection. Is this possible using HAProxy ?
Here is the solution: With TPROXY, we can pass-through clients IP to the actual server without need for forwarded-for header and it works for TCP connections.
Linux with kernel 2.6.28 and above
iptables and HAProxy with TPROXY support
Backend servers must use the node where HAPRoxy is installed as a default gateway
You already have a working HAProxy configuration
- Run below command to mark and route packets
iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 111 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 111 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100
- Set the node in forwarding mode:
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects echo 1 > /proc/sys/net/ipv4/conf/eth0/send_redirects
- In HAProxy backend proxy configuration section add:
source 0.0.0.0 usesrc clientip
Restart HAProxy service.
I found the solution for this by following steps provided in guide mentioned in below link: http://www.loadbalancer.org/blog/configure-haproxy-with-tproxy-kernel-for-full-transparent-proxy