# HAProxy to Nginx

**URL:** <https://discourse.haproxy.org/t/haproxy-to-nginx/3886>\
**Category:** Help!\
**Created:** [June 4, 2019, 5:55am UTC](https://discourse.haproxy.org/t/haproxy-to-nginx/3886 "2019-06-04T05:55:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![arashad](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@arashad](https://discourse.haproxy.org/u/arashad)\
**Post date:** [June 4, 2019, 5:55am UTC](https://discourse.haproxy.org/t/haproxy-to-nginx/3886/1 "2019-06-04T05:55:15Z")

</div>

Hello,

I currently use haproxy 1.5.18 that has a backend of two servers running Nginx listening on port 80 & 443 and i’m trying to drop haproxy but every time i try it i get “broken header while reading proxy protocol” and i think the issue might be with “send-proxy” option.  
Any recommendations will be helpful.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 4, 2019, 7:15am UTC](https://discourse.haproxy.org/t/haproxy-to-nginx/3886/2 "2019-06-04T07:15:23Z")

</div>

You will need to remove the `proxy_protocol` directive from your nginx configuration then, if you no longer use it.

---

<div class="post-metadata">

**Author:** ![arashad](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@arashad](https://discourse.haproxy.org/u/arashad)\
**Post date:** [June 4, 2019, 7:30am UTC](https://discourse.haproxy.org/t/haproxy-to-nginx/3886/3 "2019-06-04T07:30:25Z")

</div>

This is one of the virtual host files:  
i tried commenting out the proxy\_protocol but same result.

server {  
listen 0.0.0.0:443 ssl;

# listen \*:443 ssl http2 proxy\_protocol;

```
 # listen *:443 ssl http2;
    error_log /var/log/nginx/ar.islamway.net.error.log;
    server_name test.com;
    error_page 500 502 503 504 /50x.html;
  # ssl on;
    ssl_certificate /etc/letsencrypt/live/islamway.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/islamway.net/privkey.pem;
    ssl_session_cache shared:SSL:10m;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';

    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/pki/tls/dhparams.pem;
    real_ip_header proxy_protocol;

 add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; ";

```

location = /test/push.html {  
http2\_push /test/push.css;  
root /data/web/webroot3/web;  
}

```
if ($request_uri ~ 'select|union|ascii|database|undefined' ) {return 403;}

```

# set\_real\_ip\_from 127.0.0.1;

# set\_real\_ip\_from 72.52.116.87;

# set\_real\_ip\_from 72.52.116.101;

# set\_real\_ip\_from 38.76.31.223;

```
# real_ip_header proxy_protocol;

```

location ~\* ^/(sf|phplist|ramadan|gaza|hajj|team|teams|quranflash|Basateen|api|api2|kids)/ {  
proxy\_pass [http://127.0.0.1:81](http://127.0.0.1:81);  
http2\_push\_preload on;  
proxy\_connect\_timeout 2000;  
proxy\_read\_timeout 3000;  
proxy\_send\_timeout 3000;  
proxy\_set\_header Host $host;  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Accept-Encoding “”;  
proxy\_set\_header X-Forwarded-Proto $scheme;

```
    }

```

location ~\* ^/fonts/ {  
add\_header Cache-Control public;  
add\_header Access-Control-Allow-Origin \*;  
}

```
    location ~* \.(gif|jpg|jpeg|png|bmp|ico|ttf|woff|otf|eot|txt|pdf|css|js|wmv|avi|mpg|mpeg|mp4|amr|mp3|ogg|wav|wma|m3u|mid|ram|rm|rmvb|rar|psd|swf|doc|xls|exe|zip|gz|bz2|tar.gz|tar.bz2)$ {
            root /data/web/webroot3/web; # here
    http2_push_preload on;

```

add\_header Access-Control-Allow-Origin \*;  
expires max;  
}  
location / {  
proxy\_pass [http://127.0.0.1:81](http://127.0.0.1:81);  
proxy\_connect\_timeout 2000;  
proxy\_read\_timeout 3000;  
proxy\_send\_timeout 3000;  
proxy\_set\_header Host $host;  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Accept-Encoding “”;  
proxy\_set\_header X-Forwarded-Proto $scheme;

# add\_header Front-End-Https on;

```
    }

```

### S

location ~ .css$ {  
add\_header Content-Type text/css;  
proxy\_pass [https://127.0.0.1:444](https://127.0.0.1:444);  
}

location ~ .js$ {  
add\_header Content-Type application/x-javascript;  
proxy\_pass [https://127.0.0.1:444](https://127.0.0.1:444);  
}

### E

error\_page 500 502 503 504 /50x.html;  
location = /50x.html {  
root html;  
}  
location ~ /.ht {  
deny all;  
}

location /nginx\_status {  
stub\_status on;  
error\_log on;  
allow 127.0.0.1;  
allow 192.168.100.98;  
deny all;  
}

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 4, 2019, 8:17am UTC](https://discourse.haproxy.org/t/haproxy-to-nginx/3886/4 "2019-06-04T08:17:12Z")

</div>

No, you commented out `real_ip_header proxy_protocol;`. However what’s relevant is:

`listen *:443 ssl http2 proxy_protocol;`

You need to remove the `proxy_protocol` from all of the listen directives.

---

<div class="post-metadata">

**Author:** ![arashad](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@arashad](https://discourse.haproxy.org/u/arashad)\
**Post date:** [June 4, 2019, 8:21am UTC](https://discourse.haproxy.org/t/haproxy-to-nginx/3886/5 "2019-06-04T08:21:50Z")

</div>

Will try that and see.

---

<div class="post-metadata">

**Author:** ![arashad](https://avatars.discourse-cdn.com/v4/letter/a/ecb155/32.png) [@arashad](https://discourse.haproxy.org/u/arashad)\
**Post date:** [June 9, 2019, 5:48pm UTC](https://discourse.haproxy.org/t/haproxy-to-nginx/3886/6 "2019-06-09T17:48:55Z")

</div>

Commenting out the proxy\_protocol worked out.