# Tracking source IP when using proxy protocol

**URL:** <https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672>\
**Category:** Help!\
**Created:** [October 13, 2017, 1:38pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672 "2017-10-13T13:38:47Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discourse.haproxy.org/u/Exocomp)\
**Post date:** [October 13, 2017, 1:38pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/1 "2017-10-13T13:38:47Z")

</div>

Goal: Limit connections opened per IP (real client IP) when using proxy protocol

I want to limit the number of opened connections per IP when using the proxy protocol.

According to some sources it is done like so:

stick-table type ip size 100k expire 30s store conn\_cur  
tcp-request connection track-sc0 src  
tcp-request connection reject if { src\_conn\_cur gt 10 }

Problem here is using “tcp-request connection” doesn’t store the “real client IP” (remember I’m using proxy protocol).

Per the documentation:

“The PROXY protocol dictates the layer  
3/4 addresses of the incoming connection to be used everywhere an address is  
used, with the only exception of “tcp-request connection” rules which will  
only see the real connection address.”

If I use “tcp-request content” instead that works but according to the documentation “tcp connection” is more efficient.

My question is that if there are any work around to use the real client ip when using the more efficient “tcp-request connection” ?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 13, 2017, 5:18pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/2 "2017-10-13T17:18:10Z")

</div>

First of all it doesn’t make a lot of sense to block IP’s on a intermediate proxy. I would strongly suggest to block bad source IPs at the edge proxy that actually sees the client. Otherwise you will just block your own proxy, and you may self-DDoS yourself with this, as the edge proxy may retry or failover to another backend. This is especially true for “tcp-request \*”.

Also see this guy’s problem:

> [@HAProxy high connection resets using proxy protocol](https://discourse.haproxy.org/t/haproxy-high-connection-resets-using-proxy-protocol/1570):
>
> I’ve been spending the better part of a few days trying to figure this out but have not made much progress and would greatly appreciate some help. System: Ubuntu Server 16.04.3 LTS, HAProxy 1.7.9, Nginx 1.10.3 Issue: Under load or spike in traffic, around 10k/sec non-ssl or 4k/sec ssl using proxy protocol, I get random connection resets (see image as reported by haproxy). Reproducing/Troubleshooting: I’m able to reproduce the issue every time load testing using the p…

Oh wait, that’s actually you. Here we go, we found the root cause for that issue as well 😉

So, move your IP/abuse protection to the edge proxy. If you cannot do this, then use an layer 7 rejection, with “http-request deny”.

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discourse.haproxy.org/u/Exocomp)\
**Post date:** [October 13, 2017, 5:47pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/3 "2017-10-13T17:47:02Z")

</div>

@lukastribus

Well you ignored my actual question, which was using proxy protocol if there was a work around in using “tcp-request connection” using the real client ip?

> First of all it doesn’t make a lot of sense to block IP’s on a intermediate proxy.

Your making an assumption that I’m not doing that which is not true. TCP connections are handled at the edge. I’m handling http requests with intermediate HAProxy but wanted to see if it was possible to use “tcp-request connection” with the real client ip instead of having to use “http-request deny”.

> HAProxy high connection resets using proxy protocol  
> Oh wait, that’s actually you. Here we go, we found the root cause for that issue as well 😉

That’s actually a separate issue not sure what it has to do with this.

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discourse.haproxy.org/u/Exocomp)\
**Post date:** [October 13, 2017, 5:59pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/4 "2017-10-13T17:59:05Z")

</div>

Ok, I think I found the reason why proxy protocol requires the http request/content. Per the proxy protocol spec [https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) it states the real ip is sent above the http request such as:

> ```
> PROXY TCP4 192.168.0.1 192.168.0.11 56324 443\r\n
> GET / HTTP/1.1\r\n
> Host: 192.168.0.11\r\n
> \r\n
> 
> ```

tcp-request connection must not have access to that level so therefore it uses the connection IP instead of the IP from proxy protocol (educated guess on my part).

I suppose this would just be a limitation of proxy protocol the way it is designed.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 13, 2017, 6:14pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/5 "2017-10-13T18:14:43Z")

</div>

I ignored your question because I believe it would be a mistake to use either “tcp content” or “tcp connection” reject, for the reason mentioned.

> [@Exocomp](#):
>
> Your making an assumption that I’m not doing that which is not true. TCP connections are handled at the edge. I’m handling http requests with intermediate HAProxy but wanted to see if it was possible to use “tcp-request connection” with the real client ip instead of having to use “http-request deny”.

I’m not sure I understand … you are trying to block requests based on the IP address information from the PROXY protocol. Is that not true? What’s my assumption that is untrue here?

> [@Exocomp](#):
>
> That’s actually a separate issue not sure what it has to do with this.

I assumed you are blocking requests/connections in nginx in a similar matter that you are trying todo it on the intermediate haproxy instance here, which would lead to exactly to the problems explained in this thread.

---

<div class="post-metadata">

**Author:** ![AaronWest](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aaronwest/32/164_2.png) [@AaronWest](https://discourse.haproxy.org/u/AaronWest)\
**Post date:** [October 13, 2017, 6:21pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/6 "2017-10-13T18:21:08Z")

</div>

I’m just intrigued really… What is the edge proxy setup? It sends proxy protocol so could you instead maybe use Tproxy to make that one truly source IP transparent? Various proxies support it like HAproxy and Pound for example.

I’ve used Stunnel in front of HAProxy with proxy protocol and then used Tproxy with HAproxy so that my real server sees the real client IP. While not the same it got me thinking…

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discourse.haproxy.org/u/Exocomp)\
**Post date:** [October 13, 2017, 6:50pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/7 "2017-10-13T18:50:09Z")

</div>

@lukastribus

> First of all it doesn’t make a lot of sense to block IP’s on a intermediate proxy

This statement is not true. Because one can open a single TCP connection (handled at the edge) and do multiple http requests.

> I assumed you are blocking requests/connections in nginx in a similar matter that you are trying todo it on the intermediate haproxy instance here, which would lead to exactly to the problems explained in this thread.

That assumption is wrong.

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discourse.haproxy.org/u/Exocomp)\
**Post date:** [October 13, 2017, 7:01pm UTC](https://discourse.haproxy.org/t/tracking-source-ip-when-using-proxy-protocol/1672/8 "2017-10-13T19:01:49Z")

</div>

@AaronWest Interesting setup using Tproxy. I’m working with a similar setup but without Tproxy, I might give that a try one day thanks for sharing.