Skip Navigation
Selfhosted @lemmy.world
nutbutter @discuss.tchncs.de

Forward IP headers in HAProxy to get the real IP of the client

TL;DR - option forwardfor and http-request set-header X-Real-IP %[src] are not working.

My setup is slightly complicated. I have a homeserver, with HAProxy installed and some docker containers. My homeserver is, then, connected to a VPS via WireGuard which also has HAProxy installed. HAProxy on homeserver forwards the docker containers with an SSL certificate to the VPS. The VPS, then, just does TLS pass through to the clients.

The issue is, if I do not use option forwardfor in either of the 2 HAProxy configurations, I get the internal IP address of the docker container (172.XX.XX.1). If I add option forwardfor on the homeserver's HAProxy config, I get the internal IP of the WireGuard of the home server (10.0.0.2). And if I add option forwardfor to the HAProxy config of the VPS as well, I get the internal IP of the WireGuard tunnel (10.0.0.1). And as far as I know, http-request set-header X-Real-IP %[src] has no impact. I have also tried using send-proxy and send-proxy-v2, but then the whole setup stops working.

HAProxy config on home server: 

 undefined
    
global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20>
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

listen rp
        bind *:443 ssl crt /path/to/cert.pem

        acl service1 hdr_sub(host) -i service1.domain.me
        acl service2 hdr_sub(host) -i service2.domain.me

        use_backend service1_backend if service1
        use_backend service2_backend if service2

backend service1_backend
        server service1_server 127.0.0.1:8080

backend service2_backend
#       option forwardfor
#       http-request set-header X-Real-IP %[src]
        server service2_server 127.0.0.1:9090

HAProxy config on VPS: 

 undefined
    
global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon
        tune.ssl.default-dh-param       4096

defaults
        log     global
        mode    tcp
#       option  forwardfor
        timeout connect 5000
        timeout client  50000
        timeout server  50000

listen http
        bind *:80
        mode tcp
        server default 10.0.0.2:80
listen https
        bind *:443 alpn h2,http/1.1
        mode tcp
#       option forwardfor header X-Real-IP
#       http-request set-header X-Real-IP %[src]
        server main 10.0.0.2:443

I have to resort to this because I am behind CGNAT, and want TLS pass through on the VPS for privacy.

What am I doing wrong?

5 comments