Unable to connect to backend if Transparent ip is enabled in HAProxy

[justinxa]

Hi ,
I have HAProxy installed with frontend serving at 443. i have a backend serving with ssl enabled. When i enable Transparent IP, i am not able to connect to the backend.
What i really want is to connect to the backend with HTTPS mode Frontend and get the source/client ip from the traffic.

Regards,
Justin X.

[PiBa]

@justinxa

• Does the (web)server use pfSense machine as its default route?
• Is the client on a different subnet as the (web)server?

If these criteria are not met, then it will not work due to asynchronous routing and the fact that haproxy is a full proxy that terminates the client connections.

[justinxa]

@PiBa

• Does the (web)server use pfSense machine as its default route? - Yes.
• Is the client on a different subnet as the (web)server? - No. Pfsense has two NiCs attached which are on two subnet i.e. External subnet and Internal Subnet. the webserver is on the internal subnet.

Are you suggesting i keep pfsense and webserver on the same subnet.

Regards,
Justin X.

[PiBa]

@justinxa
For using transparent-client-ip i suggest moving the webserver to a different lan / vlan / OPT1 network than from where the clients are connecting from. So traffic to/from it will always pass through pfSense.

As for your question about pfSense being on the same subnet, 'yes too all'..

• pfSense and the webserver will be on the same subnet
• also pfSense and the ISP should be on the same subnet
• AND also client and pfSense would be on the same subnet...

pfSense would have 3 nic's one for each network.. (those could be vlan's which are effectively treated as additional nic's) But well needs a managed switch that can be configured to trunk and tag certain ports with vlan traffic..

.

Or, use a different solution like X-Forward-For header or proxyprotocol. Either of which would also need to be configured / supported by the (web)-server.. So the chance of these being possible are low if traffic it isn't send to a regular webserver.. And even then might need some extra plugin to support the proxyprotocol. Personally i think transparent-client-ip is the 'most compatible' option.. but well it does require separated client<>server networks....