0

I am trying to create an environment using HAProxy to allow websites hosted on a local servers (having a private IP) be accessed through SSL connection using HAProxy Server (having a public IP and local private IP). I do not want HAProxy server to manage SSL certificate for its backend servers, instead backend servers (ie local private servers) manage the certificates themself and HAProxy just use backend server's certificate to create connection. Is this possible using HAProxy ?

0

Here is the solution: With TPROXY, we can pass-through clients IP to the actual server without need for forwarded-for header and it works for TCP connections.

Requirements:

  1. Linux with kernel 2.6.28 and above

  2. iptables and HAProxy with TPROXY support

  3. Backend servers must use the node where HAPRoxy is installed as a default gateway

  4. You already have a working HAProxy configuration

Procedure:

  1. Run below command to mark and route packets
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 111
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add fwmark 111 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
  1. Set the node in forwarding mode:
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
echo 1 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 1 > /proc/sys/net/ipv4/conf/eth0/send_redirects
  1. In HAProxy backend proxy configuration section add:

source 0.0.0.0 usesrc clientip

  1. Restart HAProxy service.

  2. Done

I found the solution for this by following steps provided in guide mentioned in below link: http://www.loadbalancer.org/blog/configure-haproxy-with-tproxy-kernel-for-full-transparent-proxy

  • Although your answer is 100% correct, it might also become 100% useless if that link is moved, changed, merged into another one or the main site just disappears... :-( Therefore, please edit your answer, and copy the relevant steps from the link into your answer, thereby guaranteeing your answer for 100% of the lifetime of this site! ;-) You can always leave the link in at the bottom of your answer as a source for your material... – Donald Duck Apr 29 '17 at 13:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.