# Real IP address visibility issue

**URL:** <https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697>\
**Category:** Help!\
**Created:** [October 19, 2017, 8:21pm UTC](https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697 "2017-10-19T20:21:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dtoshev](https://avatars.discourse-cdn.com/v4/letter/d/3ec8ea/32.png) [@dtoshev](https://discourse.haproxy.org/u/dtoshev)\
**Post date:** [October 19, 2017, 8:21pm UTC](https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697/1 "2017-10-19T20:21:01Z")

</div>

Hello all,  
I am pretty much new to HAProxy, but I need to used it in order to have true-client-ip visibility. Out DDoS provider masks the real IP of the clients. All IP’s that we see in our log are couple of IP’s that we know they are from the subnet of the DDoS provider. For some audit purposes we need to see the real ip address of the client, that’s why we implement HAProxy in front of our server.  
The problem here is that I am able to see the real IP address only in the first packet which is fine, but all other sessions that are logged in the server log(like executed commands etc.) are with source IP address of the proxy server.  
I need to have the Real IP address signed on all the logs not only the first packet ?

Could you please assist.  
Let me know if additional info is needed!

Thank you in advance !

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 19, 2017, 8:34pm UTC](https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697/2 "2017-10-19T20:34:20Z")

</div>

How does the DDoS provider share the original IP with you?  
Please share the complete configuration and the output of haproxy -vv.

---

<div class="post-metadata">

**Author:** ![dtoshev](https://avatars.discourse-cdn.com/v4/letter/d/3ec8ea/32.png) [@dtoshev](https://discourse.haproxy.org/u/dtoshev)\
**Post date:** [October 20, 2017, 6:04am UTC](https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697/3 "2017-10-20T06:04:26Z")

</div>

Hello,

I forgot to mention that the protocol is not HTTP/HTTPS so XFF is not in the game.

Output of the haproxy -vv

HA-Proxy version 1.7.9 2017/08/18  
Copyright 2000-2017 Willy Tarreau [willy@haproxy.org](mailto:willy@haproxy.org)

Build options :  
TARGET = linux2628  
CPU = generic  
CC = gcc  
CFLAGS = -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv  
OPTIONS =

Default settings :  
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Encrypted password support via crypt(3): yes  
Built without compression support (neither USE\_ZLIB nor USE\_SLZ are set)  
Compression algorithms supported : identity(“identity”)  
Built without OpenSSL support (USE\_OPENSSL not set)  
Built without PCRE support (using libc’s regex instead)  
Built without Lua support  
Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND

Available polling systems :  
epoll : pref=300, test result OK  
poll : pref=200, test result OK  
select : pref=150, test result OK  
Total: 3 (3 usable), will use epoll.

Available filters :  
[COMP] compression  
[TRACE] trace  
[SPOE] spoe

Config:

global  
log /dev/log local0  
log /dev/log local1 notice  
chroot /var/lib/haproxy  
stats timeout 30s  
user haproxy  
group haproxy  
daemon

defaults  
log global  
mode tcp  
option tcplog  
option dontlognull  
timeout connect 5000  
timeout client 50000  
timeout server 50000

frontend users  
bind \*:3443 accept-proxy transparent  
mode tcp  
stats uri /  
default\_backend dcs

backend dcs  
mode tcp  
server dc 10.164.71.157:3443 check

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 20, 2017, 8:19am UTC](https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697/4 "2017-10-20T08:19:20Z")

</div>

I don’t quite understand your situation yet …

> [@dtoshev](#):
>
> The problem here is that I am able to see the real IP address only in the first packet which is fine, but all other sessions that are logged in the server log(like executed commands etc.) are with source IP address of the proxy server.

Where exactly do you see what?

I assume that on your backend server you never see the real IP address at all, not even for the first packet, because you don’t use the proxy protocol between haproxy and your backend.

In haproxy logs, you should see the real IP address, but since this is TCP you would really only have one log entry per TCP session, so I don’t understand your point about “executed commands”.

---

<div class="post-metadata">

**Author:** ![dtoshev](https://avatars.discourse-cdn.com/v4/letter/d/3ec8ea/32.png) [@dtoshev](https://discourse.haproxy.org/u/dtoshev)\
**Post date:** [October 20, 2017, 8:37am UTC](https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697/5 "2017-10-20T08:37:40Z")

</div>

Hello,

On my backend servers in the application log I am able to see that user XXX is connected from real IP address Y.Y.Y.Y  
but again in this application log each other task executed by the same user is logged with the HAPROXY IP address.

and I am not sure how it works for the first session “login” and not for the others.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 20, 2017, 10:25am UTC](https://discourse.haproxy.org/t/real-ip-address-visibility-issue/1697/6 "2017-10-20T10:25:59Z")

</div>

Yeah I don’t have any idea why you see the real IP in your application for the first request. I don’t understand your configuration so I’m afraid I’m unable to help, sorry.