HAPROXY and IPSEC problem with transparent IP in backend

[xadhoom]

Hi, I have a problem using HAPROXY and TRANSPARENT IPCLIENT backend.
When connecting from IPSEC interface, if I try to do an http or https to the webserver inside the LAN, it can't answer back.
Only disabling the TRANSPARENT IPCLIENT in backend solved but we lost the logging of ip client connection.

Is there a way to tell haproxy not to consider request from IPSEC ? ANY ideas ?
best regards

[PiBa]

i dont think it matters your using ipsec..
When using transparent-client-ip feature ALL reply traffic from the webserver:port is redirected to the pfsense system ip-stack for haproxy to pick up..
This also happens when accessing a server on opt1 from the lan-network..

It is a limitation of the ipfw & pf firewall combination required to make transparent-client-ip work..

Workaround might be to portforward incoming requests over ipsec or other to haproxy.

Its a known issue, also in the warning/explanation near the transparent-client-ip setting, however to get it solved a patch to pf is needed.. https://redmine.pfsense.org/issues/3943 . Not sure if/when that will get applied..