# Haproxy in transparent mode not working with Palo Alto

**URL:** <https://discourse.haproxy.org/t/haproxy-in-transparent-mode-not-working-with-palo-alto/61>\
**Category:** Help!\
**Created:** [January 8, 2016, 10:05am UTC](https://discourse.haproxy.org/t/haproxy-in-transparent-mode-not-working-with-palo-alto/61 "2016-01-08T10:05:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![andy\_uk23](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@andy\_uk23](https://discourse.haproxy.org/u/andy_uk23)\
**Post date:** [January 8, 2016, 10:05am UTC](https://discourse.haproxy.org/t/haproxy-in-transparent-mode-not-working-with-palo-alto/61/1 "2016-01-08T10:05:50Z")

</div>

We are an educational setting, currently rolling out a new web filtering solution. We don’t want to have to configure all devices with proxy settings, instead we want to make this transparent to the user. I.e. with no proxy settings set – the Palo Alto firewall will pass traffic via Policy Based Routing to the filtering system which consists of 4 filter boxes. Therefore we understand we need an HAProxy server running as a load balancer and transparent proxy to do this.

Our setup:

Client subnet (10.20.64.0/24)  
|  
|  
V  
PALO ALTO FW (PBR)  
|  
|  
V  
HAPROXY (VIP 10.20.6.29/22)  
|  
|  
V  
FILTER SERVERS (e.g. 10.20.4.101– device has gateway of 10.20.6.29)

We have successfully configured an HAProxy server so that when the haproxy IP address is set in the web browser, we can browse the internet and be filtered appropriately. The filters successfully see the originating client IP to apply policies accordingly. However, as soon as the proxy settings are removed from the browser and we let the Firewall do the PBR, whilst traffic does hit the HAProxy server (seen by TCPDump) – it is not seen or handled by the HAProxy service. There are no entries in the haproxy logs. Do you have any suggestions as to what is wrong? I can confirm the client range and servers are on the same “zone” on the Palo Alto whilst on different subnets.

OS: Centos 6.7  
Kernel: 2.6.32-573.12.1.el6.x86\_64  
HAProxy version: 1.5.4

Haproxy config file:

```
global
        log 127.0.0.1 local2
        chroot /var/lib/haproxy
        user root
        group root
        daemon
        debug

defaults
        log global
        option dontlognull
        timeout connect 5000
        timeout client 50000
        timeout server 50000

frontend filter_http
        bind 10.20.6.29:80 transparent
        default_backend filter_app_http

backend filter_app_http
        mode http
        source 0.0.0.0 usesrc clientip
        server filter1 10.20.4.101:3128 check
        server filter2 10.20.4.102:3128 check
        server filter3 10.20.4.103:3128 check
        server filter4 10.20.4.104:3128 check

```

Firewall and other routing config:

```
# iptables -L -n -t mangle
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain DIVERT (1 references)
target prot opt source destination
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x1
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

# ip rule show
0: from all lookup local
32765: from all fwmark 0x1 lookup 100
32766: from all lookup main
32767: from all lookup default

#ip route show table 100
local default dev lo scope host

```

`# netstat -lntp | grep 80`  
`tcp 0 0 10.20.6.29:80 0.0.0.0:* LISTEN 1391/haproxy`

```
# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.ip_nonlocal_bind = 1
```

---

<div class="post-metadata">

**Author:** ![Baptiste](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@Baptiste](https://discourse.haproxy.org/u/Baptiste)\
**Post date:** [January 15, 2016, 3:36am UTC](https://discourse.haproxy.org/t/haproxy-in-transparent-mode-not-working-with-palo-alto/61/2 "2016-01-15T03:36:45Z")

</div>

Have you had a look at this blog entry which explains you everything:

> **[Transparent Proxying and Binding with HAProxy and ALOHA Load Balancer - HOWTO...](https://www.haproxy.com/blog/howto-transparent-proxying-and-binding-with-haproxy-and-aloha-load-balancer/)**
>
> Transparent Proxy HAProxy works has a reverse-proxy. Which means it maintains 2 connections when allowing a client to cross it: – 1 connection between HAProxy and the client – 1 connection between HAProxy and the server HAProxy then manipulate...

---

<div class="post-metadata">

**Author:** ![andy\_uk23](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@andy\_uk23](https://discourse.haproxy.org/u/andy_uk23)\
**Post date:** [January 22, 2016, 3:36pm UTC](https://discourse.haproxy.org/t/haproxy-in-transparent-mode-not-working-with-palo-alto/61/3 "2016-01-22T15:36:21Z")

</div>

Hi Baptiste. I had indeed followed those instructions however have not had any luck. I am not sure if I am over complicating my situation. I need to do some more testing and will come back to you once I have more evidence of what works and what doesn’t. I do know that if we take the HAProxy out of the diagram above, and policy base route to one of the filter servers directly, this works as expected.

---

<div class="post-metadata">

**Author:** ![tux453](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@tux453](https://discourse.haproxy.org/u/tux453)\
**Post date:** [May 25, 2016, 2:54pm UTC](https://discourse.haproxy.org/t/haproxy-in-transparent-mode-not-working-with-palo-alto/61/4 "2016-05-25T14:54:58Z")

</div>

Any resolution followup available on this andy\_uk23? I’m seeing a similar set of circumstances with a DansGuardian transparent proxy from a Palo Alto that works fine with our other firewall, but with the Palo Alto in place the packets show up in the tcpdump but proxy software never sees the traffic.

I’ve seen some iptables manipulation on the proxy recommended that may provide a solution, but that wasn’t required with the previous firewall so I’m not convinced why that would be needed now (and have technical reasons why in my particular environment I’d like to avoid going that route).

Thanks for any followup.

---

<div class="post-metadata">

**Author:** ![andy\_uk23](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@andy\_uk23](https://discourse.haproxy.org/u/andy_uk23)\
**Post date:** [May 26, 2016, 9:14am UTC](https://discourse.haproxy.org/t/haproxy-in-transparent-mode-not-working-with-palo-alto/61/5 "2016-05-26T09:14:42Z")

</div>

We found HAProxy did not suit our needs in the end. Due to time constraints we tested and quickly implemented Linux Virtual Server (LVS) Direct Routing instead to distribute the traffic across the filter servers. This is working perfectly for our situation. Hope this information is useful to others.