# Backend IP exposed

**URL:** <https://discourse.haproxy.org/t/backend-ip-exposed/3679>\
**Category:** Help!\
**Created:** [April 2, 2019, 12:57am UTC](https://discourse.haproxy.org/t/backend-ip-exposed/3679 "2019-04-02T00:57:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![talion](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@talion](https://discourse.haproxy.org/u/talion)\
**Post date:** [April 2, 2019, 12:57am UTC](https://discourse.haproxy.org/t/backend-ip-exposed/3679/1 "2019-04-02T00:57:43Z")

</div>

Hello all,

I am stress testing my HAProxy setup and i noticed that my backend IP is exposed! When i make same test to my nginx proxy the IP addresses is not shown to my stress tool. Is it by design or its my configuration mistake ?

I am proxying my another nginx installation with HAProxy.

* * *

echo “GET [http://Frontend](http://Frontend) IP:8088/app\_api.php” | vegeta -cpus=4 attack -connections=1000000 -timeout=2m -rate=30000 -workers=50 | tee results.bin | vegeta report  
^CRequests [total, rate] 14470, 3902.70  
Duration [total, attack, wait] 4.036639963s, 3.707685559s, 328.954404ms  
Latencies [mean, 50, 95, 99, max] 20.845444ms, 0s, 0s, 272.588244ms, 4.021258059s  
Bytes In [total, mean] 15390, 1.06  
Bytes Out [total, mean] 0, 0.00  
Success [ratio] 0.00%  
Status Codes [code:count] 0:14350 404:30 429:90  
Error Set:  
Get [http://Frontend](http://Frontend) IP:8088/app\_api.php: dial tcp: lookup p1.dtv.sx on 127.0.0.53:53: no such host  
Get [http://Frontend](http://Frontend) IP:8088/app\_api.php: dial tcp: lookup p1.dtv.sx on 127.0.0.53:53: dial udp 127.0.0.53:53: socket: too many open files  
404 Not Found  
429 Too Many Requests  
Get [http://Frontend](http://Frontend) IP:8088/app\_api.php: dial tcp 0.0.0.0:0-\>Backend IP:8088:8000: socket: too many open files  
Get [http://Frontend](http://Frontend) IP:8088/app\_api.php: dial tcp 0.0.0.0:0-\>Backend IP:8088:8000: connect: connection refused

* * *

HAProxy Configuration;

global  
nbproc 1  
nbthread 4  
cpu-map auto:1/1-4 0-3  
log /dev/log local0  
log /dev/log local1 notice  
chroot /var/lib/haproxy  
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners  
stats timeout 30s  
user haproxy  
group haproxy  
daemon  
maxconn 1000000

```
    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # Default ciphers to use on SSL-enabled listening sockets.
    # For more information, see ciphers(1SSL). This list is from:
    # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
    # An alternative list with additional directives can be obtained from
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
    ssl-default-bind-options no-sslv3

```

defaults  
log global  
mode http  
option httplog  
option dontlognull  
retries 3  
#option forwardfor  
option http-server-close  
option redispatch  
option http-buffer-request  
timeout http-request 10s  
timeout queue 1m  
timeout connect 10s  
timeout client 1m  
timeout server 1m  
timeout http-keep-alive 10s  
timeout check 10s  
errorfile 400 /etc/haproxy/errors/400.http  
errorfile 403 /etc/haproxy/errors/403.http  
errorfile 408 /etc/haproxy/errors/408.http  
errorfile 500 /etc/haproxy/errors/500.http  
errorfile 502 /etc/haproxy/errors/502.http  
errorfile 503 /etc/haproxy/errors/503.http  
errorfile 504 /etc/haproxy/errors/504.http  
maxconn 300000

backend per\_ip\_rates  
stick-table type ip size 1m expire 10m store http\_req\_rate(10s)

frontend fe1  
bind :8088  
mode http  
http-request track-sc0 src table per\_ip\_rates  
http-request deny deny\_status 429 if { sc\_http\_req\_rate(0) gt 100 }  
reqidel ^X-Forwarded-For:.\*  
default\_backend backend\_servers

backend backend\_servers  
mode http  
balance roundrobin  
option httpchk  
server domain1 backendIP check port 80

listen stats  
bind :19090  
stats enable  
stats hide-version  
stats refresh 10s  
stats show-legends  
stats realm HAProxy\ Statistics  
stats show-node  
stats auth  
stats uri /

HAProxy -vv ;

HA-Proxy version 1.9.6-1ppa1~bionic 2019/03/30 - [https://haproxy.org/](https://haproxy.org/)  
Build options :  
TARGET = linux2628  
CPU = generic  
CC = gcc  
CFLAGS = -O2 -g -O2 -fdebug-prefix-map=/build/haproxy-YXfmbO/haproxy-1.9.6=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D\_FORTIFY\_SOURCE=2 -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-format-truncation -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-old-style-declaration -Wno-ignored-qualifiers -Wno-clobbered -Wno-missing-field-initializers -Wno-implicit-fallthrough -Wno-stringop-overflow -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference  
OPTIONS = USE\_GETADDRINFO=1 USE\_ZLIB=1 USE\_REGPARM=1 USE\_OPENSSL=1 USE\_LUA=1 USE\_SYSTEMD=1 USE\_PCRE2=1 USE\_PCRE2\_JIT=1 USE\_NS=1

Default settings :  
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with OpenSSL version : OpenSSL 1.1.0g 2 Nov 2017  
Running on OpenSSL version : OpenSSL 1.1.0g 2 Nov 2017  
OpenSSL library supports TLS extensions : yes  
OpenSSL library supports SNI : yes  
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2  
Built with Lua version : Lua 5.3.3  
Built with network namespace support.  
Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND  
Built with zlib version : 1.2.11  
Running on zlib version : 1.2.11  
Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”)  
Built with PCRE2 version : 10.31 2018-02-12  
PCRE2 library supports JIT : yes  
Encrypted password support via crypt(3): yes  
Built with multi-threading support.

Available polling systems :  
epoll : pref=300, test result OK  
poll : pref=200, test result OK  
select : pref=150, test result OK  
Total: 3 (3 usable), will use epoll.

Available multiplexer protocols :  
(protocols marked as cannot be specified using ‘proto’ keyword)  
h2 : mode=HTX side=FE|BE  
h2 : mode=HTTP side=FE  
 : mode=HTX side=FE|BE  
 : mode=TCP|HTTP side=FE|BE

Available filters :  
[SPOE] spoe  
[COMP] compression  
[CACHE] cache  
[TRACE] trace

Thanks!

Talion

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 2, 2019, 8:53pm UTC](https://discourse.haproxy.org/t/backend-ip-exposed/3679/2 "2019-04-02T20:53:22Z")

</div>

I cannot possible tell what your benchmark tool does and where it gets it’s informations from.

Analyze the issue and clarify what and how haproxy is actually leaking.

---

<div class="post-metadata">

**Author:** ![talion](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@talion](https://discourse.haproxy.org/u/talion)\
**Post date:** [April 3, 2019, 3:51pm UTC](https://discourse.haproxy.org/t/backend-ip-exposed/3679/3 "2019-04-03T15:51:05Z")

</div>

Hello Lukastribus,

Thank you for your answer.

How shall i analyze it correctly ? 🙂

And nginx didnt expose with same test fyi… If it may give any clue.

Thanks!

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 3, 2019, 4:12pm UTC](https://discourse.haproxy.org/t/backend-ip-exposed/3679/4 "2019-04-03T16:12:45Z")

</div>

Find out what the vegeta tool is doing and where this IP comes from.

---

<div class="post-metadata">

**Author:** ![talion](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@talion](https://discourse.haproxy.org/u/talion)\
**Post date:** [April 3, 2019, 4:29pm UTC](https://discourse.haproxy.org/t/backend-ip-exposed/3679/5 "2019-04-03T16:29:56Z")

</div>

I setup a new haproxy server and i didnt setup any iptables and didnt modify sysct.conf. And now IP not exposed. Perhaps something about it?

Here are my sysct and iptables;

kernel.printk = 4 4 1 7  
kernel.panic = 10  
kernel.sysrq = 0  
kernel.shmmax = 4294967296  
kernel.shmall = 4194304  
kernel.core\_uses\_pid = 1  
kernel.msgmnb = 65536  
kernel.msgmax = 65536  
vm.swappiness = 10  
vm.dirty\_ratio = 80  
vm.dirty\_background\_ratio = 5  
fs.file-max = 2097152  
net.core.netdev\_max\_backlog = 262144  
net.core.rmem\_default = 31457280  
net.core.rmem\_max = 67108864  
net.core.wmem\_default = 31457280  
net.core.wmem\_max = 67108864  
net.core.somaxconn = 65535  
net.core.optmem\_max = 25165824  
net.ipv4.neigh.default.gc\_thresh1 = 4096  
net.ipv4.neigh.default.gc\_thresh2 = 8192  
net.ipv4.neigh.default.gc\_thresh3 = 16384  
net.ipv4.neigh.default.gc\_interval = 5  
net.ipv4.neigh.default.gc\_stale\_time = 120  
net.netfilter.nf\_conntrack\_max = 10000000  
net.netfilter.nf\_conntrack\_tcp\_loose = 0  
net.netfilter.nf\_conntrack\_tcp\_timeout\_established = 1800  
net.netfilter.nf\_conntrack\_tcp\_timeout\_close = 10  
net.netfilter.nf\_conntrack\_tcp\_timeout\_close\_wait = 10  
net.netfilter.nf\_conntrack\_tcp\_timeout\_fin\_wait = 20  
net.netfilter.nf\_conntrack\_tcp\_timeout\_last\_ack = 20  
net.netfilter.nf\_conntrack\_tcp\_timeout\_syn\_recv = 20  
net.netfilter.nf\_conntrack\_tcp\_timeout\_syn\_sent = 20  
net.netfilter.nf\_conntrack\_tcp\_timeout\_time\_wait = 10  
net.ipv4.tcp\_slow\_start\_after\_idle = 0  
net.ipv4.ip\_local\_port\_range = 1024 65000  
net.ipv4.ip\_no\_pmtu\_disc = 1  
net.ipv4.route.flush = 1  
net.ipv4.route.max\_size = 8048576  
net.ipv4.icmp\_echo\_ignore\_broadcasts = 1  
net.ipv4.icmp\_ignore\_bogus\_error\_responses = 1  
net.ipv4.tcp\_congestion\_control = htcp  
net.ipv4.tcp\_mem = 65536 131072 262144  
net.ipv4.udp\_mem = 65536 131072 262144  
net.ipv4.tcp\_rmem = 4096 87380 33554432  
net.ipv4.udp\_rmem\_min = 16384  
net.ipv4.tcp\_wmem = 4096 87380 33554432  
net.ipv4.udp\_wmem\_min = 16384  
net.ipv4.tcp\_max\_tw\_buckets = 1440000  
net.ipv4.tcp\_tw\_reuse = 1  
net.ipv4.tcp\_max\_orphans = 400000  
net.ipv4.tcp\_window\_scaling = 1  
net.ipv4.tcp\_rfc1337 = 1  
net.ipv4.tcp\_syncookies = 1  
net.ipv4.tcp\_synack\_retries = 1  
net.ipv4.tcp\_syn\_retries = 2  
net.ipv4.tcp\_max\_syn\_backlog = 16384  
net.ipv4.tcp\_timestamps = 1  
net.ipv4.tcp\_sack = 1  
net.ipv4.tcp\_fack = 1  
net.ipv4.tcp\_ecn = 2  
net.ipv4.tcp\_fin\_timeout = 10  
net.ipv4.tcp\_keepalive\_time = 600  
net.ipv4.tcp\_keepalive\_intvl = 60  
net.ipv4.tcp\_keepalive\_probes = 10  
net.ipv4.tcp\_no\_metrics\_save = 1  
net.ipv4.ip\_forward = 0  
net.ipv4.conf.all.accept\_redirects = 0  
net.ipv4.conf.all.send\_redirects = 0  
net.ipv4.conf.all.accept\_source\_route = 0  
net.ipv4.conf.all.rp\_filter = 1

/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP  
/sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP  
/sbin/iptables -t mangle -A PREROUTING -p icmp -j DROP  
/sbin/iptables -t mangle -A PREROUTING -f -j DROP  
/sbin/iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset  
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT  
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP  
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT  
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP

Thanks!

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [April 3, 2019, 4:34pm UTC](https://discourse.haproxy.org/t/backend-ip-exposed/3679/6 "2019-04-03T16:34:53Z")

</div>

There is literally no way for us to know with the information you provided.

If you don’t understand the vegeta output either, ask vegeta support.