# HAProxy with PostgreSQL for Transparent IP

**URL:** <https://discourse.haproxy.org/t/haproxy-with-postgresql-for-transparent-ip/3527>\
**Category:** Help!\
**Created:** [February 18, 2019, 10:30am UTC](https://discourse.haproxy.org/t/haproxy-with-postgresql-for-transparent-ip/3527 "2019-02-18T10:30:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jobinau](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/jobinau/32/756_2.png) [@jobinau](https://discourse.haproxy.org/u/jobinau)\
**Post date:** [February 18, 2019, 10:30am UTC](https://discourse.haproxy.org/t/haproxy-with-postgresql-for-transparent-ip/3527/1 "2019-02-18T10:30:22Z")

</div>

I have HAProxy configuration like :

listen master  
bind \*:5000  
option httpchk OPTIONS /master  
http-check expect status 200  
default-server inter 3s fall 3 rise 2 on-marked-down shutdown-sessions  
server pg0 pg0:5432 maxconn 100 check port 8008  
server pg1 pg1:5432 maxconn 100 check port 8008  
server pg2 pg2:5432 maxconn 100 check port 8008

How to have Transparent IP configuration such that client IP is passed to Server rather than IP of the HAProxy server?

---

<div class="post-metadata">

**Author:** ![ciprian.craciun](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/ciprian.craciun/32/722_2.png) [@ciprian.craciun](https://discourse.haproxy.org/u/ciprian.craciun)\
**Post date:** [February 18, 2019, 12:01pm UTC](https://discourse.haproxy.org/t/haproxy-with-postgresql-for-transparent-ip/3527/2 "2019-02-18T12:01:52Z")

</div>

> [@jobinau](#):
>
> How to have Transparent IP configuration such that client IP is passed to Server rather than IP of the HAProxy server?

With HAProxy (to my knowledge) there are 3 ways to pass the original client information to the backend server. In order from simplest (i.e. recommended) to most complex:

- exposing a `X-Forwarded-For` (and accompanying) headers;
- using the `PROXY` protocol;
- using HAProxy in “transparent proxy” mode, which involves some lower-level networking configuration;

* * *

That said I would strongly suggest using the `X-Forwarded-For` header configured by HAProxy with either:

- the `option forwardfor` ([HAProxy version 1.8.30 - Configuration Manual](http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4.2-option%20forwardfor)) feature;
- by using the `http-request set-header` option ([HAProxy version 1.8.30 - Configuration Manual](http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4-http-request)), like so (which also exposes if HTTPS was used or not)

```auto
    acl https-active ssl_fc

    http-request set-header X-Forwarded-Proto 'https' if https-active
    http-request set-header X-Forwarded-Proto 'http' if !https-active

    http-request set-header X-Forwarded-Port '443' if https-active
    http-request set-header X-Forwarded-Port '80' if !https-active

    http-request set-header X-Forwarded-For "%ci"

```

* * *

The second (less suggested option) is to use the `PROXY` protocol by using the `send-proxy-v2` server option ([HAProxy version 1.8.30 - Configuration Manual](http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#send-proxy-v2)).

However in both cases you’ll have to configure your backend server to trust the `X-Forwarded-*` headers, or to “speak” the `PROXY` protocol. And for this reason I say the headers is the easiest one as it works out-of-the-box with almost any HTTP server.

---

<div class="post-metadata">

**Author:** ![sasskinn12](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sasskinn12](https://discourse.haproxy.org/u/sasskinn12)\
**Post date:** [December 16, 2021, 7:49am UTC](https://discourse.haproxy.org/t/haproxy-with-postgresql-for-transparent-ip/3527/3 "2021-12-16T07:49:54Z")

</div>

Hi, i tried the second method eg. using the `PROXY` protocol; (send-proxy-v2 and send-proxy) without success. Postgres gives me an error during authorization.

```auto
LOG: invalid length of startup packet

```

Could you please give an example how to use X-Forwarded-For in HAProxy tcp mode?  
Or there are any other options. The point is i need source IP 's to be visible on backend server. Currently i see only HAProxy as source IP for all db connected hosts.

Thanks in advice.