# HAProxy + Squid + NTLM = Not Working! Help!

**URL:** <https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398>\
**Category:** Help!\
**Created:** [July 3, 2017, 3:21pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398 "2017-07-03T15:21:38Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 3, 2017, 3:21pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/1 "2017-07-03T15:21:38Z")

</div>

Hello Sharks,

I have the folow scenario:

[Client] ----------\> [HaProxy] ----------\> [Squid1] or [Squid2]

Using NTLM Authentication in both Squid. All workin fine excepts by INTERNET EXPLORER.

In Chrome is OK. In Firefox is OK. But the Internet Explorer (11) show always the prompt for credentials ever.

Anyone can help me?

Below my haproxy.cfg  
defaults  
mode http  
option httplog  
option dontlognull  
option forwardfor except 127.0.0.1/8# Necessario para logar o IP do cliente  
option redispatch  
retries 7  
timeout http-request 10s  
timeout queue 1m  
timeout connect 5000ms  
timeout client 50000ms  
timeout server 50000ms  
timeout http-keep-alive 10s  
timeout check 10s  
frontend squid\_frontend  
bind \*:3128  
default\_backend squid\_backend  
option prefer-last-server  
option http-keep-alive # Necessario para o NTLM  
option forwardfor  
backend squid\_backend  
option prefer-last-server # NTLM  
option http-keep-alive # Necessario para o NTLM  
server squid126 172.19.0.126:3128 check  
server squid127 172.19.0.127:3128 check  
server squid128 172.19.0.128:3128 check  
balance source

Thanks!

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 3, 2017, 6:02pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/2 "2017-07-03T18:02:01Z")

</div>

I think Chrome and Firefox may not actually do NTLM and fallback to basic authentication.

For NTLM, I would generally recommend tunnel mode (“option http-tunnel”), with a long enough “timeout tunnel”.

With http-keep-alive mode, use a longer keep-alive timeout (timeout http-keep-alive), see if that helps, but, like I said, I would use tunnel mode.

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 3, 2017, 9:56pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/3 "2017-07-03T21:56:01Z")

</div>

Thanks @lukastribus,

This works fine … with tunnel mode …

But on the server squid the log show the IP of Haproxy instead the Client IP

How I fix this? How the Haproxy send and the Squid receive the real Client IP instead the HaProxy IP?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 4, 2017, 7:43am UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/4 "2017-07-04T07:43:03Z")

</div>

That doesn’t work in tunnel mode (only the first request will have the IP).  
In Squid \>= 3.5 you could use the PROXY protocol, this would solve your issue.

Otherwise go back to keep-alive mode, but use a high “timeout http-keep-alive” setting, like a few minutes. That should improve the situation (but NTLM is and always will be a mess).

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 4, 2017, 11:28am UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/5 "2017-07-04T11:28:44Z")

</div>

@lukastribus, thank you again … you are the man …

Yes, my Squid is 3.5, but how works the PROXY Protocol? Do you have a example of configuration in squid.conf that fix this issue and show the real ip? The Proxy protocol is in Squid side or Haproxy side?

I try this in haproxy.cfg:

server squid126 172.19.0.126:3128 check send-proxy  
and  
server squid126 172.19.0.126:3128 check send-proxy-v2

but doesn’t work … the internet on client don’t work …

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 4, 2017, 12:06pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/6 "2017-07-04T12:06:40Z")

</div>

I quickly searched through squid documentation. If I understand correctly, for x-forwarded-for to work, you currently specify the follow\_x\_forwarded\_for directive, allowing the haproxy IP. You would need to do the same by using the proxy\_protocol\_access directive:

[http://www.squid-cache.org/Versions/v3/3.5/cfgman/proxy\_protocol\_access.html](http://www.squid-cache.org/Versions/v3/3.5/cfgman/proxy_protocol_access.html)

Also you may need to add the “require-proxy-header” argument in your http\_port directive:  
[http://www.squid-cache.org/Versions/v3/3.5/cfgman/http\_port.html](http://www.squid-cache.org/Versions/v3/3.5/cfgman/http_port.html)

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 4, 2017, 12:56pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/7 "2017-07-04T12:56:08Z")

</div>

Dear @lukastribus,

I follow your suggest and All Works …

In haproxy I put:  
server squid126 172.19.0.126:3128 check send-proxy

In Squid.conf I put:  
acl haproxyip src 172.19.0.121  
proxy\_protocol\_access allow haproxyip  
http\_port 172.19.0.126:3128 require-proxy-header  
via on  
follow\_x\_forwarded\_for allow all # Necessario para passar o IP do Cliente no haproxy  
request\_header\_access X-Forwarded-For allow all  
request\_header\_access Allow allow all  
forwarded\_for on

And works fine … Thank’s for your support!

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 4, 2017, 1:20pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/8 "2017-07-04T13:20:36Z")

</div>

Great, thanks for confirming.

FYI:

> [@gianfcn](#):
>
> follow\_x\_forwarded\_for allow all # Necessario para passar o IP do Cliente no haproxy

This is probably a security issue. Everybody can specify any IP Address in x-forwarded-for and squid will log that one. Now that you are using PROXY, you can remove this option altogether. If you would still be using x-forwarded-for, you would have to set this to the haproxy IP, instead of “allow all” for that reason.

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 4, 2017, 2:54pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/9 "2017-07-04T14:54:03Z")

</div>

Another issue …

When I’m logged on domain (therefore NTLM) the Internet is work fine … but when I access on PC that is not logged in domain (therefore not NTLM) the access is denied, and the internet doesn’t work …

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 4, 2017, 3:53pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/10 "2017-07-04T15:53:57Z")

</div>

And what would be expected behavior in the non-NTLM case? Does it work without haproxy?

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 5, 2017, 11:28am UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/11 "2017-07-05T11:28:04Z")

</div>

That the internet works with manual proxy configuration. In the same scenario without HaProxy works fine.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 5, 2017, 11:52am UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/12 "2017-07-05T11:52:03Z")

</div>

Any logs in hapoxy about the failed request?

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 5, 2017, 4:15pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/13 "2017-07-05T16:15:36Z")

</div>

On Squid the LOG says:

TCP\_DENIED/407 4219 CONNECT [ssl.gstatic.com:443](http://ssl.gstatic.com:443) - HIER\_NONE/- text/html

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 5, 2017, 4:21pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/14 "2017-07-05T16:21:24Z")

</div>

Did it work when NOT using PROXY? If yes, then this could be a bug in squid.

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 5, 2017, 4:25pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/15 "2017-07-05T16:25:35Z")

</div>

No. This error is after change the squid and haproxy to use “proxy protocol”.

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 5, 2017, 4:33pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/16 "2017-07-05T16:33:42Z")

</div>

It seems that haproxy does not pass the user and password to squid with the proxy protocol enabled. With the proxy protocol enabled the machines logged in the domain work well, but those that are not in the domain, is asking for the authentication screen all the time.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 5, 2017, 4:55pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/17 "2017-07-05T16:55:37Z")

</div>

No, haproxy doesn’t even look at the request anymore. This seems like a squid bug to me.

---

<div class="post-metadata">

**Author:** ![gianfcn](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gianfcn](https://discourse.haproxy.org/u/gianfcn)\
**Post date:** [July 5, 2017, 5:05pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/18 "2017-07-05T17:05:24Z")

</div>

On my Squid, there are two steps of authentication:

1 - NTLM

Then

2 - Basic

---

<div class="post-metadata">

**Author:** ![jandro](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jandro](https://discourse.haproxy.org/u/jandro)\
**Post date:** [November 29, 2017, 1:00pm UTC](https://discourse.haproxy.org/t/haproxy-squid-ntlm-not-working-help/1398/19 "2017-11-29T13:00:18Z")

</div>

@gianfcn I have the same problem with the same settings, but in my case, I have two diferents clusters, with the same settings. In our enviroment with squid 3.5.13 and haproxy 1.5.18 works fine, but in the other enviroment with squid 3-5.25 and haproxy 1.5.18, the NTLM authentication only works if at first you request a https URL.