I have had configured transparent proxy mode in HAproxy with my configure shown below:
global
maxconn 5000
stats socket /var/run/haproxy.stat mode 600 level admin
log 127.0.0.1 local2
tune.ssl.default-dh-param 2048
nogetaddrinfo
stats bind-process 1
nbproc 1
user root
group root
defaults
mode tcp
#option forwardfor
#option http-server-close
timeout http-request 30s
timeout connect 30s
timeout server 60s
timeout client 60s
listen stats
mode http
bind-process 1
bind 192.168.56.103:81
stats enable
stats uri /
stats realm HAProxy Statistics
stats auth admin:admin
frontend port80
bind-process 1
#bind *:80 transparent
bind 192.168.56.103:80 transparent
maxconn 5000
mode tcp
#option http-server-close
#option forwardfor except 127.0.0.1
default_backend backend_port80
backend backend_port80
mode tcp
#bind-process all
log global
balance roundrobin
#option forwardfor
source 0.0.0.0 usesrc clientip
server test1 192.168.56.105:80 check
server test2 192.168.56.110:80 check
And here is my kernel config by sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.all.send_redirects = 1
net.ipv4.ip_nonlocal_bind = 1
And here is iptables and routing
iptables -A POSTROUTING -t nat -j MASQUERADE
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
I also enabled xt_TPROXY in Centos 7.
xt_TPROXY 17327 0
nf_defrag_ipv6 35104 1 xt_TPROXY
nf_defrag_ipv4 12729 1 xt_TPROXY
My backend server is webserver by apache2.4, I couldn't see IP client in the log. I did't know why transparent proxy didn't work. I also set up my HAproxy be to backend's default-gateway but still doesn't work
Best Answer
I think you are missing the most important line:
i.e. tell HAProxy to replace the source IP. As described here: https://www.loadbalancer.org/blog/configure-haproxy-with-tproxy-kernel-for-full-transparent-proxy/