# Get the real-ip on the backend servers with SSL pass-through

**URL:** <https://discourse.haproxy.org/t/get-the-real-ip-on-the-backend-servers-with-ssl-pass-through/6055>\
**Category:** Help!\
**Created:** [December 31, 2020, 10:58am UTC](https://discourse.haproxy.org/t/get-the-real-ip-on-the-backend-servers-with-ssl-pass-through/6055 "2020-12-31T10:58:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dr-ing](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@dr-ing](https://discourse.haproxy.org/u/dr-ing)\
**Post date:** [December 31, 2020, 10:58am UTC](https://discourse.haproxy.org/t/get-the-real-ip-on-the-backend-servers-with-ssl-pass-through/6055/1 "2020-12-31T10:58:55Z")

</div>

Hello,

my backend servers that I have configured on my haproxy are running fail2ban and for that I need the real-ip / malicious ip, otherwise fail2ban would block my haproxy ip as this ip appears in my web server logs.

Over HTTP this works fine with `option forwardfor` and using the X-Forwarded-For header, but is something like this also possible over HTTPS, while HAproxy only passes SSL and the termination happens on the backend servers?

Here is a snippet of my HAproxy configuration:

```
        frontend http_in
          mode http
          bind *:80
          option forwardfor
          option httplog
          use_backend http_%[req.hdr(host),lower,map_str(/etc/haproxy/maps/backends.map,servers)]

    frontend https_in
      mode tcp
      tcp-request content accept if { req_ssl_hello_type 1 }
      tcp-request inspect-delay 5s
      bind *:443
      option tcplog
      # option forwardfor -> doesnt work as HAproxy cant edit the header?!
      use_backend https_%[req.ssl_sni(),lower,map(/etc/haproxy/maps/backends.map,servers)]

backend http_servers
  mode http
  option forwardfor
  server a1 10.0.13.37:80 check
  ...

backend https_servers
  mode tcp
  option ssl-hello-chk
  server a1 10.0.13.37:443 check
  server a2 ...

```

HA-Proxy version 1.7.5-2 2017/05/17  
OS: Debian GNU/Linux 9 (stretch) / Linux 4.9.0-14-amd64 #1 SMP Debian 4.9.240-2 (2020-10-30) x86\_64 GNU/Linux

---

<div class="post-metadata">

**Author:** ![baptiste64](https://avatars.discourse-cdn.com/v4/letter/b/46a35a/32.png) [@baptiste64](https://discourse.haproxy.org/u/baptiste64)\
**Post date:** [December 31, 2020, 3:55pm UTC](https://discourse.haproxy.org/t/get-the-real-ip-on-the-backend-servers-with-ssl-pass-through/6055/2 "2020-12-31T15:55:58Z")

</div>

Hi,  
You could use the proxy protocol to pass the client ip information with the tcp session: [HAProxy version 2.0.19 - Configuration Manual](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#send-proxy-v2)