# I want to hide destination IP and port of backend

**URL:** <https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205>\
**Category:** Help!\
**Created:** [May 11, 2020, 4:54am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205 "2020-05-11T04:54:46Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 11, 2020, 4:54am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/1 "2020-05-11T04:54:46Z")

</div>

Hi Everyone,  
I am new to HAProxy setup. I don’t know what i am doing wrong, please if anyone can help me.  
I have 2 applications ( Grafana and Konga) running in below IP/port .  
Grafana =\> 169.144.62.128:32323  
Konga =\> 169.144.62.128:30018  
And my HAProxy server is 169.144.62.165.  
I want to configure like when i will browse URL [http://169.144.62.165/grafana](http://169.144.62.165/grafana) , it will open Grafana application and when i will browse for [http://169.144.62.165/konga](http://169.144.62.165/konga) , it will open konga. Below is my code, i don’t know what wrong i am doing -

frontend mylab  
bind 169.144.62.165:80  
acl PATH\_grafana path\_beg -i /grafana  
acl PATH\_conga path\_beg -i /conga  
use\_backend grafana-backend if PATH\_grafana  
use\_backend conga-backend if PATH\_conga

backend grafana-backend  
mode http tcp  
server grafana1 169.144.62.128:32323

backend conga-backend  
mode http tcp  
server konga1 169.144.62.128:30018

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 12, 2020, 6:28am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/2 "2020-05-12T06:28:41Z")

</div>

Anyone can help me please?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 12, 2020, 3:57pm UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/3 "2020-05-12T15:57:58Z")

</div>

Share the entire configuration, not only parts of it, replace mode tcp with mode http everywhere (after all, you want to access the HTTP path in your variable), make sure that both grafana and conga are aware and configured to use the respectives paths `/grafana` and `/conga` (as opposed to root) and if it still doesn’t work, please elaborate exactly how this fails (which error messages, etc).

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 13, 2020, 5:36am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/4 "2020-05-13T05:36:11Z")

</div>

There is no actual path in applications like /grafana and /conga. Actual path may be IP:port/login. I want like user will browse with haproxy IP:port/grafana and it will redirect to actual application server ip:port

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 13, 2020, 7:07am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/5 "2020-05-13T07:07:40Z")

</div>

Unless you can configure the path in your applications, this will never work, because the internal links will be all wrong and haproxy won’t route them to the correct backend, because the path doesn’t contain `/grafana` or `/conga`.

If you can configure the path in your applications good, otherwise you need to change your haproxy configuration and use different hostnames instead of a different path.

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 13, 2020, 7:23am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/6 "2020-05-13T07:23:29Z")

</div>

Thanks for your reply. i have one question like if i have heard about one thing to use in this kind of case like ‘reqrep’ . Can i use it in my scenario to achieve my object? i am just asking as i am new to this. i mean it can convert user request /grafana to actual backend like /login or only /

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 13, 2020, 7:38am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/7 "2020-05-13T07:38:56Z")

</div>

No, `reqrep` can adjust the HTTP request header. It doesn’t adjust wrong links in the HTTP payload.

That’s why you have those two options mentioned earlier. Either the backends knows it doesn’t run at `/`, or you need to use different hostnames instead.

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 13, 2020, 8:17am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/8 "2020-05-13T08:17:05Z")

</div>

Again many thanks. Sorry to say, but i am not understanding use of different hostnames. Can you please say in little details? You mean to say different hostnames for 2 application links? can i use /etc/hosts files? but 2 applications exists in same server only different port.  
Like you want -  
169.144.62.128:32323 [grafana.localdomain.net](http://grafana.localdomain.net)  
169.144.62.128:30018 [konga.localdomain.net](http://konga.localdomain.net)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 13, 2020, 9:01am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/9 "2020-05-13T09:01:22Z")

</div>

You point to hostname to the IP address of haproxy (`169.144.62.165`). In DNS, or in `/etc/hosts` - whatever works best for your specific scenario. Note that you cannot specify a port, this is a name -\> ip address association.

In your browser you do not access the services via `http://169.144.62.165/`, but via the hostnames instead.

So DNS:

```
169.144.62.165 grafana.localdomain.net
169.144.62.165 konga.localdomain.net

```

Then in haproxy, you configure it in HTTP mode and pick your backend based on the host header:

frontend mylab  
mode http  
bind 169.144.62.165:80  
use\_backend grafana-backend if { hdr(host) -i [grafana.localdomain.net](http://grafana.localdomain.net) }  
use\_backend conga-backend if { hdr(host) -i [conga.localdomain.net](http://conga.localdomain.net) }

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 13, 2020, 10:15am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/10 "2020-05-13T10:15:50Z")

</div>

Thanks you sir. So ultimately below is my configuration, i am going to apply. is it right?

global

```
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon

stats socket /var/lib/haproxy/stats

```

defaults  
mode http  
log global  
option httplog  
option dontlognull  
option http-server-close  
option forwardfor except 127.0.0.0/8  
option redispatch  
retries 3  
timeout http-request 10s  
timeout queue 1m  
timeout connect 10s  
timeout client 1m  
timeout server 1m  
timeout http-keep-alive 10s  
timeout check 10s  
maxconn 3000

frontend mylab  
mode http  
bind 169.144.62.165:80  
use\_backend grafana-backend if { hdr(host) -i [grafana.localdomain.net](http://grafana.localdomain.net) }  
use\_backend conga-backend if { hdr(host) -i [conga.localdomain.net](http://conga.localdomain.net) }

backend grafana-backend  
server master-node 169.144.61.128:32323

backend conga-backend  
server master-node 169.144.61.128:30018

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 13, 2020, 1:07pm UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/11 "2020-05-13T13:07:47Z")

</div>

Yes, that’s what I mean.

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 14, 2020, 12:36pm UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/12 "2020-05-14T12:36:24Z")

</div>

Great Sir. This is working like a charm. Thanks a lot.  
Now i have one another query to add authentication on this. i was trying but asking credential multiple time, even after login in application. Any suggestion sir? It will be helpful if you can give me the code.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 15, 2020, 7:09am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/13 "2020-05-15T07:09:19Z")

</div>

You want to introduce authentication at haproxy layer? Or is there a problem with the application authentication that you want to fix?

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 15, 2020, 8:37am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/14 "2020-05-15T08:37:31Z")

</div>

i want to introduce sir.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 15, 2020, 9:08am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/15 "2020-05-15T09:08:40Z")

</div>

Refer to the documentation regarding:

http-request auth:  
[https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#4.2-http-request%20auth](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#4.2-http-request%20auth)

user/group/userlists  
[https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#3.4](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#3.4)

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 15, 2020, 9:29am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/16 "2020-05-15T09:29:48Z")

</div>

This code is connecting to app1 but not opening page for app2.

userlist UsersFor\_Auth  
user admin insecure-password letmein  
user test1 insecure-password abc123

frontend example1\_in  
bind \*:443 ssl crt /etc/pki/tls/certs/haproxy1.pem  
acl host\_example1 hdr(host) -i www.kolkatalab.net-app1  
acl host\_example2 hdr(host) -i www.kolkatalab.net-app2  
acl authorized http\_auth(UsersFor\_Auth)  
http-request auth realm Example1 if host\_example1 !authorized  
http-request auth realm Example2 if host\_example2 !authorized  
use\_backend app1-bkend if host\_example1 authorized  
use\_backend app2-bkend if host\_example2 authorized

#### 

backend app1-bkend  
http-request set-header X-Client-IP %[src]  
server app1 192.168.1.100:32323 check  
http-request del-header Authorization

backend app2-bkend  
http-request set-header X-Client-IP %[src]  
server app2 192.168.1.100:5050 check  
http-request del-header Authorization

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 15, 2020, 9:40am UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/17 "2020-05-15T09:40:44Z")

</div>

Does app2 have their own Basic HTTP authentication? What exactly fails (which HTTP response code, which error message)?

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 15, 2020, 12:01pm UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/18 "2020-05-15T12:01:15Z")

</div>

Now i did this code but app2 is not opening. App1 and App3 is opening. And the error is 503 Service Unavailable,No server is available to handle this request.

userlist UsersFor\_Auth  
user admin insecure-password letmein  
user test1 insecure-password abc123

frontend example1\_in  
bind \*:443 ssl crt /etc/pki/tls/certs/haproxy1.pem  
acl host\_example1 hdr(host) -i kolkatalab.net-grafana  
acl host\_example2 hdr(host) -i kolkatalab.net-pgadmin  
acl host\_example3 hdr(host) -i kolkatalab.net-nginx  
acl authorized http\_auth(UsersFor\_Auth)  
http-request auth realm Example1 if host\_example1 !authorized  
http-request auth realm Example1 if host\_example1 !authorized  
http-request auth realm Example1 if host\_example3 !authorized  
redirect scheme https if !{ ssl\_fc }  
mode http  
use\_backend grafana-bkend if host\_example1 authorized  
use\_backend pgadmin-bkend if host\_example2 authorized  
use\_backend nginx-bkend if host\_example3 authorized

backend grafana-bkend  
http-request set-header X-Client-IP %[src]  
server grafana1 192.168.1.100:32323 check  
http-request del-header Authorization

backend pgadmin-bkend  
http-request set-header X-Client-IP %[src]  
mode http  
option forwardfor  
option httpchk HEAD / HTTP/1.1\r\nHost:localhost  
http-request set-header X-Forwarded-Port %[dst\_port]  
http-request add-header X-Forwarded-Proto https if { ssl\_fc }  
server pgadmin1 192.168.1.100:5050 check  
http-request del-header Authorization

backend nginx-bkend  
http-request set-header X-Client-IP %[src]  
server nginx1 192.168.1.100:30080 check  
http-request del-header Authorization

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 15, 2020, 12:11pm UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/19 "2020-05-15T12:11:08Z")

</div>

So which backend is app2? Either your replace the names in all configurations or none.

---

<div class="post-metadata">

**Author:** ![chandandas.dh](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@chandandas.dh](https://discourse.haproxy.org/u/chandandas.dh)\
**Post date:** [May 15, 2020, 12:40pm UTC](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205/20 "2020-05-15T12:40:50Z")

</div>

app2 means backend pgadmin-bkend ( second backend)

[Next page](https://discourse.haproxy.org/t/i-want-to-hide-destination-ip-and-port-of-backend/5205.md?page=2)