Tracking source IP when using proxy protocol

[lukastribus]

I ignored your question because I believe it would be a mistake to use either “tcp content” or “tcp connection” reject, for the reason mentioned.

@Exocomp

Your making an assumption that I’m not doing that which is not true. TCP connections are handled at the edge. I’m handling http requests with intermediate HAProxy but wanted to see if it was possible to use “tcp-request connection” with the real client ip instead of having to use “http-request deny”.

I’m not sure I understand … you are trying to block requests based on the IP address information from the PROXY protocol. Is that not true? What’s my assumption that is untrue here?

@Exocomp

That’s actually a separate issue not sure what it has to do with this.

I assumed you are blocking requests/connections in nginx in a similar matter that you are trying todo it on the intermediate haproxy instance here, which would lead to exactly to the problems explained in this thread.