Hi, we have microservices running behind HAPROXY load balancer. One of the components(TCP component) is based on TCP connections. This component is unable to publish client_ip rather its publishing the load balancers IP(HAPROXY IP) as client_ip.
Below are the frontend and backend section configurations:
frontend tcp-frontend-mqtt-tls
mode tcp
bind : <8883>
log global
log-format %ci\ %fi:%fp\ [%t]\ %ft\ %b/%s\ %Tw/%Tc/%Tt\ %B\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq
tcp-request connection reject if { src -f deny_list.lst }
default_backend tcp-backend-mqtt-tls
backend tcp-backend-gateway-mqtt-tls
mode tcp
log global
balance leastconn
server mqtt-node-0 <IP_address>:61628 resolvers <dns_server> check inter 1000
global section in haproxy.config
global
log 127.0.0.1 local1 info
daemon
user <username>
group <usergroup>
maxconn 64000
spread-checks 4
tune.ssl.default-dh-param 2048
ssl-default-bind-options force-tlsv12
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
default section in haproxy.config
defaults
maxconn 64000
option http-server-close
option httplog
option forwardfor
option contstats
timeout connect 5000ms
timeout client 30000ms
timeout server 30000ms
timeout tunnel 3600000ms
timeout http-keep-alive 1000ms
timeout http-request 30000ms
timeout queue 30000ms
errorfile 504 errorfiles/504.http
I have tried the following possibilities in modifying haproxy.
modification in backend section
server mqtt-node-0 <IP_address>:<port>resolvers <dns_server> check send-proxyv-v2
server mqtt-node-0 <IP_address>:<port> resolvers <dns_server> check send-proxy-v2-ssl
After modifying the haproxy TCP component is polling with below error
TCP Component logs
[2020-09-08 18:44:28.188] ERROR mqtt [BrokerService[mqtt-0] Task-13] --- TransportConnector: Could not accept connection from null : java.io.IOException: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
In the TCP component, we are trying to publish the client IP with the following code
Q1. How can we preserve client_ip when the connection is terminated at the backend server.
1 post - 1 participant