If this has already been asked and I’ve missed it my apologies.
I’m looking to use Linux’s netfilter transparent proxy feature to redirect all inbound traffic (across a wide destination port range) to HAProxy which would be listening on a single port.
HAProxy’s intended job in the backend is to then establish a proxy protocol v2 connection to the backend server (via this proxy protocol documentation Enable the Proxy Protocol | HAProxy config tutorials).
The idea here is to maintain the original client IP that connected to HAProxy, maintain the destination port the client connected to, avoid the need for custom routes on the backend servers as we’re using proxy protocol between HAProxy and the backend servers and not transparent forwarding. And lastly since HAProxy is just binding on one port the overhead of bound port lookup is avoided in the kernel as the number of ports being used by clients grows.
You could consider this intended implementation to be a cutdown version of Abusing Linux's firewall: the hack that allowed us to build Spectrum. Though we’re not needing to listen on all IPs, just all ports.
While I’ve found documentation on how to get netfilter to perform the redirect (https://www.kernel.org/doc/Documentation/networking/tproxy.txt) I’ve not found documentation on HAProxy discussing what, if anything I need to configure in HAProxy’s frontend so connections are handled appropriately. Or is there nothing to configure on the frontend as HAProxy doesn’t ‘care’ at this point if the packets destination port number doesn’t match the bound port number and when it comes to the backend it retrieves the port number from the packet and not the fact the packet happened to be received on a particular bound port?
Going by the documentation, the transparent option on the bind statement in HAProxy instructs HAProxy to bind even if the IP is not local, though it doesn’t look like this option will help in the case I’m looking at which is to find out which destination port the client connected to.
And lastly, is this use of tproxy (for the frontend) and proxy protocol v2 (for the backend) compatible in HAProxy? Admittedly I can try and find out, figured I’d ask before digging in and presumably stumbling along the way as I’ve not found anyone discussing such a configuration.
Thanks!