HAProxy TCP Transparent Mode Remote Servershaproxy tcp transparent mode on the same box as serviceTomcat 6 session replication does not work with HAProxyHaproxy logging not workHA-Proxy 301 re-direct: https to https://wwwHaProxy giving - 503 Service UnavailableHAProxy not logging all requestsRedis & HAProxy - updated configuration settings?SASL auth to LDAP behind HAPROXY with name mismatchesTransparent HAProxy, clients cannot connectopenldap with haproxy - (ldap_result() failed: Can't contact LDAP server)

How did the Vostok ejection seat safely eject an astronaut from a sealed space capsule?

Explain why a line can never intersect a plane in exactly two points.

Very tricky nonogram - where to go next?

Explicit song lyrics checker

Justifying Affordable Bespoke Spaceships

Going back in time in and initial value problem

Encounter design and XP thresholds

Why is "Congress shall have power to enforce this article by appropriate legislation" necessary?

King or Queen-Which piece is which?

Is there a difference between an NFC and RFID chip?

Is there a term for the belief that "if it's legal, it's moral"?

Why does std::string_view create a dangling view in a ternary expression?

What triggered jesuits' ban on infinitesimals in 1632?

Are there any individual aliens that have gained superpowers in the Marvel universe?

Is there a name for the trope when there is a moments dialogue when someone pauses just before they leave the room?

Cut the gold chain

Greeting with "Ho"

Should I include an appendix for inessential, yet related worldbuilding to my story?

Why is it easier to balance a non-moving bike standing up than sitting down?

Helping ease my back pain by studying 13 hours everyday , even weekends

What is the most suitable position for a bishop here?

Too early in the morning to have SODA?

Why don't we have a weaning party like Avraham did?

How do I remove this inheritance-related code smell?



HAProxy TCP Transparent Mode Remote Servers


haproxy tcp transparent mode on the same box as serviceTomcat 6 session replication does not work with HAProxyHaproxy logging not workHA-Proxy 301 re-direct: https to https://wwwHaProxy giving - 503 Service UnavailableHAProxy not logging all requestsRedis & HAProxy - updated configuration settings?SASL auth to LDAP behind HAPROXY with name mismatchesTransparent HAProxy, clients cannot connectopenldap with haproxy - (ldap_result() failed: Can't contact LDAP server)






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;








5















Alright so I have a server box with HAProxy installed and I need it to forward traffic to two MySQL servers. They are both located in completely different datacenters. It works when I have this removed from the config:
source 0.0.0.0 usesrc clientip
However, when enabled I can't get a response from the MySQL servers.



I have these IPTables rules on the HAProxy server:
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 111
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add dev eth0 fwmark 111 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100



And no connection can be made. However, when I add this:
iptables -A POSTROUTING -t nat -j MASQUERADE



It works but the client IP is not being sent, just the proxy IP.



The MySQL servers are configured to have the HAProxy server's ip as their default gateway.



I'm not sure if this is even possible, I've been messing with this for days.



My HAProxy config:



global
log 127.0.0.1 local0 debug
daemon

defaults
log global
retries 2
#option dontlognull
option tcp-smart-accept
option tcp-smart-connect
option tcplog
option log-health-checks
timeout connect 3000
timeout server 5000
timeout client 5000

frontend mysql-frontend
bind 100.111.111.111:3306 transparent
default_backend mysql-backend

backend mysql-backend
mode tcp
source 0.0.0.0 usesrc clientip
option mysql-check user haproxy_check
server mysql1 192.111.111.111:3306 check
server mysql2 200.111.111.111:3306 check


Route tables for one of the MySQL servers:



Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 100.111.111.111 0.0.0.0 UG 2 0 0 eth0
100.111.111.111 0.0.0.0 255.255.255.255 UH 2 0 0 eth0
192.111.111.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo



Sysctl for the HAProxy box:



net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.all.send_redirects = 1
net.ipv4.conf.eth0.send_redirects = 1
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.default.accept_source_route = 0



The TProxy module is also compiled into HAProxy, and the required kernel modules are enabled as well.



There is also only one interface, eth0.



Please let me know what I'm doing wrong, or if this is even possible!



Thanks!










share|improve this question






























    5















    Alright so I have a server box with HAProxy installed and I need it to forward traffic to two MySQL servers. They are both located in completely different datacenters. It works when I have this removed from the config:
    source 0.0.0.0 usesrc clientip
    However, when enabled I can't get a response from the MySQL servers.



    I have these IPTables rules on the HAProxy server:
    iptables -t mangle -N DIVERT
    iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
    iptables -t mangle -A DIVERT -j MARK --set-mark 111
    iptables -t mangle -A DIVERT -j ACCEPT
    ip rule add dev eth0 fwmark 111 lookup 100
    ip route add local 0.0.0.0/0 dev lo table 100



    And no connection can be made. However, when I add this:
    iptables -A POSTROUTING -t nat -j MASQUERADE



    It works but the client IP is not being sent, just the proxy IP.



    The MySQL servers are configured to have the HAProxy server's ip as their default gateway.



    I'm not sure if this is even possible, I've been messing with this for days.



    My HAProxy config:



    global
    log 127.0.0.1 local0 debug
    daemon

    defaults
    log global
    retries 2
    #option dontlognull
    option tcp-smart-accept
    option tcp-smart-connect
    option tcplog
    option log-health-checks
    timeout connect 3000
    timeout server 5000
    timeout client 5000

    frontend mysql-frontend
    bind 100.111.111.111:3306 transparent
    default_backend mysql-backend

    backend mysql-backend
    mode tcp
    source 0.0.0.0 usesrc clientip
    option mysql-check user haproxy_check
    server mysql1 192.111.111.111:3306 check
    server mysql2 200.111.111.111:3306 check


    Route tables for one of the MySQL servers:



    Destination Gateway Genmask Flags Metric Ref Use Iface
    0.0.0.0 100.111.111.111 0.0.0.0 UG 2 0 0 eth0
    100.111.111.111 0.0.0.0 255.255.255.255 UH 2 0 0 eth0
    192.111.111.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
    127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo



    Sysctl for the HAProxy box:



    net.ipv4.ip_forward = 1
    net.ipv4.conf.all.forwarding = 1
    net.ipv4.conf.all.accept_redirects = 1
    net.ipv4.conf.all.send_redirects = 1
    net.ipv4.conf.eth0.send_redirects = 1
    net.ipv4.ip_nonlocal_bind = 1
    net.ipv4.conf.default.rp_filter = 2
    net.ipv4.conf.default.accept_source_route = 0



    The TProxy module is also compiled into HAProxy, and the required kernel modules are enabled as well.



    There is also only one interface, eth0.



    Please let me know what I'm doing wrong, or if this is even possible!



    Thanks!










    share|improve this question


























      5












      5








      5


      2






      Alright so I have a server box with HAProxy installed and I need it to forward traffic to two MySQL servers. They are both located in completely different datacenters. It works when I have this removed from the config:
      source 0.0.0.0 usesrc clientip
      However, when enabled I can't get a response from the MySQL servers.



      I have these IPTables rules on the HAProxy server:
      iptables -t mangle -N DIVERT
      iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
      iptables -t mangle -A DIVERT -j MARK --set-mark 111
      iptables -t mangle -A DIVERT -j ACCEPT
      ip rule add dev eth0 fwmark 111 lookup 100
      ip route add local 0.0.0.0/0 dev lo table 100



      And no connection can be made. However, when I add this:
      iptables -A POSTROUTING -t nat -j MASQUERADE



      It works but the client IP is not being sent, just the proxy IP.



      The MySQL servers are configured to have the HAProxy server's ip as their default gateway.



      I'm not sure if this is even possible, I've been messing with this for days.



      My HAProxy config:



      global
      log 127.0.0.1 local0 debug
      daemon

      defaults
      log global
      retries 2
      #option dontlognull
      option tcp-smart-accept
      option tcp-smart-connect
      option tcplog
      option log-health-checks
      timeout connect 3000
      timeout server 5000
      timeout client 5000

      frontend mysql-frontend
      bind 100.111.111.111:3306 transparent
      default_backend mysql-backend

      backend mysql-backend
      mode tcp
      source 0.0.0.0 usesrc clientip
      option mysql-check user haproxy_check
      server mysql1 192.111.111.111:3306 check
      server mysql2 200.111.111.111:3306 check


      Route tables for one of the MySQL servers:



      Destination Gateway Genmask Flags Metric Ref Use Iface
      0.0.0.0 100.111.111.111 0.0.0.0 UG 2 0 0 eth0
      100.111.111.111 0.0.0.0 255.255.255.255 UH 2 0 0 eth0
      192.111.111.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
      127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo



      Sysctl for the HAProxy box:



      net.ipv4.ip_forward = 1
      net.ipv4.conf.all.forwarding = 1
      net.ipv4.conf.all.accept_redirects = 1
      net.ipv4.conf.all.send_redirects = 1
      net.ipv4.conf.eth0.send_redirects = 1
      net.ipv4.ip_nonlocal_bind = 1
      net.ipv4.conf.default.rp_filter = 2
      net.ipv4.conf.default.accept_source_route = 0



      The TProxy module is also compiled into HAProxy, and the required kernel modules are enabled as well.



      There is also only one interface, eth0.



      Please let me know what I'm doing wrong, or if this is even possible!



      Thanks!










      share|improve this question
















      Alright so I have a server box with HAProxy installed and I need it to forward traffic to two MySQL servers. They are both located in completely different datacenters. It works when I have this removed from the config:
      source 0.0.0.0 usesrc clientip
      However, when enabled I can't get a response from the MySQL servers.



      I have these IPTables rules on the HAProxy server:
      iptables -t mangle -N DIVERT
      iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
      iptables -t mangle -A DIVERT -j MARK --set-mark 111
      iptables -t mangle -A DIVERT -j ACCEPT
      ip rule add dev eth0 fwmark 111 lookup 100
      ip route add local 0.0.0.0/0 dev lo table 100



      And no connection can be made. However, when I add this:
      iptables -A POSTROUTING -t nat -j MASQUERADE



      It works but the client IP is not being sent, just the proxy IP.



      The MySQL servers are configured to have the HAProxy server's ip as their default gateway.



      I'm not sure if this is even possible, I've been messing with this for days.



      My HAProxy config:



      global
      log 127.0.0.1 local0 debug
      daemon

      defaults
      log global
      retries 2
      #option dontlognull
      option tcp-smart-accept
      option tcp-smart-connect
      option tcplog
      option log-health-checks
      timeout connect 3000
      timeout server 5000
      timeout client 5000

      frontend mysql-frontend
      bind 100.111.111.111:3306 transparent
      default_backend mysql-backend

      backend mysql-backend
      mode tcp
      source 0.0.0.0 usesrc clientip
      option mysql-check user haproxy_check
      server mysql1 192.111.111.111:3306 check
      server mysql2 200.111.111.111:3306 check


      Route tables for one of the MySQL servers:



      Destination Gateway Genmask Flags Metric Ref Use Iface
      0.0.0.0 100.111.111.111 0.0.0.0 UG 2 0 0 eth0
      100.111.111.111 0.0.0.0 255.255.255.255 UH 2 0 0 eth0
      192.111.111.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
      127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo



      Sysctl for the HAProxy box:



      net.ipv4.ip_forward = 1
      net.ipv4.conf.all.forwarding = 1
      net.ipv4.conf.all.accept_redirects = 1
      net.ipv4.conf.all.send_redirects = 1
      net.ipv4.conf.eth0.send_redirects = 1
      net.ipv4.ip_nonlocal_bind = 1
      net.ipv4.conf.default.rp_filter = 2
      net.ipv4.conf.default.accept_source_route = 0



      The TProxy module is also compiled into HAProxy, and the required kernel modules are enabled as well.



      There is also only one interface, eth0.



      Please let me know what I'm doing wrong, or if this is even possible!



      Thanks!







      haproxy transparent-proxy






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Jul 8 '16 at 16:56







      Rhododendron

















      asked Jul 8 '16 at 16:50









      RhododendronRhododendron

      4315




      4315




















          1 Answer
          1






          active

          oldest

          votes


















          5














          Transparent mode requires that the haproxy be the default gateway of the backend servers. Remote servers won't work.






          share|improve this answer

























          • Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP.

            – Rhododendron
            Jul 8 '16 at 17:50












          • You don't. Pick a different solution.

            – longneck
            Jul 8 '16 at 17:52











          • What available solutions are there that can get me the origin IP in this instance? I can't find anything.

            – Rhododendron
            Jul 8 '16 at 17:53












          • With remote servers and the origin IP on the packet? None.

            – longneck
            Jul 8 '16 at 17:54






          • 1





            This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best.

            – longneck
            Jul 8 '16 at 17:57











          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "2"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f788726%2fhaproxy-tcp-transparent-mode-remote-servers%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          5














          Transparent mode requires that the haproxy be the default gateway of the backend servers. Remote servers won't work.






          share|improve this answer

























          • Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP.

            – Rhododendron
            Jul 8 '16 at 17:50












          • You don't. Pick a different solution.

            – longneck
            Jul 8 '16 at 17:52











          • What available solutions are there that can get me the origin IP in this instance? I can't find anything.

            – Rhododendron
            Jul 8 '16 at 17:53












          • With remote servers and the origin IP on the packet? None.

            – longneck
            Jul 8 '16 at 17:54






          • 1





            This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best.

            – longneck
            Jul 8 '16 at 17:57















          5














          Transparent mode requires that the haproxy be the default gateway of the backend servers. Remote servers won't work.






          share|improve this answer

























          • Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP.

            – Rhododendron
            Jul 8 '16 at 17:50












          • You don't. Pick a different solution.

            – longneck
            Jul 8 '16 at 17:52











          • What available solutions are there that can get me the origin IP in this instance? I can't find anything.

            – Rhododendron
            Jul 8 '16 at 17:53












          • With remote servers and the origin IP on the packet? None.

            – longneck
            Jul 8 '16 at 17:54






          • 1





            This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best.

            – longneck
            Jul 8 '16 at 17:57













          5












          5








          5







          Transparent mode requires that the haproxy be the default gateway of the backend servers. Remote servers won't work.






          share|improve this answer















          Transparent mode requires that the haproxy be the default gateway of the backend servers. Remote servers won't work.







          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited Jul 14 '16 at 19:01

























          answered Jul 8 '16 at 17:48









          longnecklongneck

          21k34176




          21k34176












          • Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP.

            – Rhododendron
            Jul 8 '16 at 17:50












          • You don't. Pick a different solution.

            – longneck
            Jul 8 '16 at 17:52











          • What available solutions are there that can get me the origin IP in this instance? I can't find anything.

            – Rhododendron
            Jul 8 '16 at 17:53












          • With remote servers and the origin IP on the packet? None.

            – longneck
            Jul 8 '16 at 17:54






          • 1





            This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best.

            – longneck
            Jul 8 '16 at 17:57

















          • Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP.

            – Rhododendron
            Jul 8 '16 at 17:50












          • You don't. Pick a different solution.

            – longneck
            Jul 8 '16 at 17:52











          • What available solutions are there that can get me the origin IP in this instance? I can't find anything.

            – Rhododendron
            Jul 8 '16 at 17:53












          • With remote servers and the origin IP on the packet? None.

            – longneck
            Jul 8 '16 at 17:54






          • 1





            This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best.

            – longneck
            Jul 8 '16 at 17:57
















          Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP.

          – Rhododendron
          Jul 8 '16 at 17:50






          Is it not possible for a remote gateway? And then how would I be able to do this then as I need the origin IP.

          – Rhododendron
          Jul 8 '16 at 17:50














          You don't. Pick a different solution.

          – longneck
          Jul 8 '16 at 17:52





          You don't. Pick a different solution.

          – longneck
          Jul 8 '16 at 17:52













          What available solutions are there that can get me the origin IP in this instance? I can't find anything.

          – Rhododendron
          Jul 8 '16 at 17:53






          What available solutions are there that can get me the origin IP in this instance? I can't find anything.

          – Rhododendron
          Jul 8 '16 at 17:53














          With remote servers and the origin IP on the packet? None.

          – longneck
          Jul 8 '16 at 17:54





          With remote servers and the origin IP on the packet? None.

          – longneck
          Jul 8 '16 at 17:54




          1




          1





          This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best.

          – longneck
          Jul 8 '16 at 17:57





          This is one of those situations where you re-think the requirements. You have three things in play here: true origin IP, remote servers and a load balancer. Eliminate any one of those things and you have a workable solution. It's up to you to decide what's best.

          – longneck
          Jul 8 '16 at 17:57

















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Server Fault!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f788726%2fhaproxy-tcp-transparent-mode-remote-servers%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          Wikipedia:Vital articles Мазмуну Biography - Өмүр баян Philosophy and psychology - Философия жана психология Religion - Дин Social sciences - Коомдук илимдер Language and literature - Тил жана адабият Science - Илим Technology - Технология Arts and recreation - Искусство жана эс алуу History and geography - Тарых жана география Навигация менюсу

          Bruxelas-Capital Índice Historia | Composición | Situación lingüística | Clima | Cidades irmandadas | Notas | Véxase tamén | Menú de navegacióneO uso das linguas en Bruxelas e a situación do neerlandés"Rexión de Bruxelas Capital"o orixinalSitio da rexiónPáxina de Bruselas no sitio da Oficina de Promoción Turística de Valonia e BruxelasMapa Interactivo da Rexión de Bruxelas-CapitaleeWorldCat332144929079854441105155190212ID28008674080552-90000 0001 0666 3698n94104302ID540940339365017018237

          What should I write in an apology letter, since I have decided not to join a company after accepting an offer letterShould I keep looking after accepting a job offer?What should I do when I've been verbally told I would get an offer letter, but still haven't gotten one after 4 weeks?Do I accept an offer from a company that I am not likely to join?New job hasn't confirmed starting date and I want to give current employer as much notice as possibleHow should I address my manager in my resignation letter?HR delayed background verification, now jobless as resignedNo email communication after accepting a formal written offer. How should I phrase the call?What should I do if after receiving a verbal offer letter I am informed that my written job offer is put on hold due to some internal issues?Should I inform the current employer that I am about to resign within 1-2 weeks since I have signed the offer letter and waiting for visa?What company will do, if I send their offer letter to another company