3

Initially I deployed HAProxy so that it would be possible to notice bad traffic going into my web server (rather than it being obscured by TLS), but now I noticed the rather obvious problem that once it has gone through the loadbalancer, it's no longer associated with the originating IP.

Any ideas whether it's possible to get Snort to track problem packets' through HAProxy? FYI, I'm currently I'm running Snort and HAProxy on the same server. My full setup usually includes a script like fail2ban, hence the desire to identify these remote hosts.

| improve this question | | | | |
  • My thoughts was that while it might be technically possible, it might not be desirable, in such a case I'd welcome more general advice on good practices. Though you're right that the title doesn't make this clear. Edited title to reflect this. – Thoughtitious Apr 29 '15 at 17:55
  • Ah - much better question. – schroeder Apr 29 '15 at 17:58
2

I don't know about Snort but I know a bit about load balancers. So here's a few things that might be useful.

  • Move the Snort sensor to be before HAProxy.
  • Leave the sensor where it is but turn HAProxy into a transparent proxy. This requires the "usesrc clientip" directive.
  • Leave the sensor where it is but let HAProxy insert the "x-forwarded-for" header (if you're using HTTP) and then let Snort read that header by using the "enable_xff" directive

EDIT: Removed suggestions incompatible with TLS decryption. The remaining suggestion should work for HTTP (only HTTP). And only useful if you've got something that can decode the unified2 data (barnyard2, u2pewfoo) as that's what Snort will record the "True-Client-IP" into, there's no option to have it be logged as the origin. See URL below for further information.

https://snort.org/faq/readme-http_inspect

| improve this answer | | | | |
  • Thanks, the following thoughts come to mind for those suggestions: a) this removes the benefit of being able to study the packets decrypted, b) presumably this also couldn't be used with decryption either, c) this sounds promising, I'll attempt to implement it soon. – Thoughtitious Apr 29 '15 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.