HAproxy Transparent Proxy doesn’t work

haproxy

I have had configured transparent proxy mode in HAproxy with my configure shown below:

global
  maxconn 5000
  stats socket /var/run/haproxy.stat mode 600 level admin
  log 127.0.0.1 local2
  tune.ssl.default-dh-param 2048
  nogetaddrinfo
  stats bind-process 1
  nbproc 1
  user root
  group root

defaults
  mode tcp
  #option forwardfor
  #option http-server-close
  timeout http-request 30s
  timeout connect 30s
  timeout server 60s
  timeout client 60s

listen stats
  mode http
  bind-process 1
  bind 192.168.56.103:81
  stats enable
  stats uri     /
  stats realm   HAProxy Statistics
  stats auth    admin:admin


frontend port80
  bind-process 1
  #bind *:80 transparent
  bind 192.168.56.103:80 transparent
  maxconn 5000
  mode tcp
  #option http-server-close
  #option forwardfor except 127.0.0.1
  default_backend backend_port80


backend backend_port80
  mode tcp
  #bind-process all
  log global
  balance roundrobin
  #option forwardfor
  source 0.0.0.0 usesrc clientip
  server test1 192.168.56.105:80 check
  server test2 192.168.56.110:80 check

And here is my kernel config by sysctl -p

net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.all.send_redirects = 1
net.ipv4.ip_nonlocal_bind = 1

And here is iptables and routing

 iptables -A POSTROUTING -t nat -j MASQUERADE
 iptables -t mangle -N DIVERT
 iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
 iptables -t mangle -A DIVERT -j MARK --set-mark 1
 iptables -t mangle -A DIVERT -j ACCEPT
 ip rule add fwmark 1 lookup 100
 ip route add local 0.0.0.0/0 dev lo table 100

I also enabled xt_TPROXY in Centos 7.

xt_TPROXY              17327  0
nf_defrag_ipv6         35104  1 xt_TPROXY
nf_defrag_ipv4         12729  1 xt_TPROXY 

My backend server is webserver by apache2.4, I couldn't see IP client in the log. I did't know why transparent proxy didn't work. I also set up my HAproxy be to backend's default-gateway but still doesn't work

Best Answer

I think you are missing the most important line:

source 0.0.0.0 usesrc clientip

i.e. tell HAProxy to replace the source IP. As described here: https://www.loadbalancer.org/blog/configure-haproxy-with-tproxy-kernel-for-full-transparent-proxy/