Home / server / Questions / 302040
Accepted
Derek Downey
Asked: 2011-08-18 05:04:58 +0800 CST

How to make requests to WAN appear from frontend HAProxy IP, instead of backend server IPs?

  • 772

I've got a web farm set up something like this:

          |-------------------> Apache1
          |
 HAProxy -|
          |
          |-------------------> Apache2

HAproxy has external IP x.x.x.x

Apache1 has 2 interfaces: internal y.y.y.y (for requests from HAProxy), and external IP z.z.z.z

Apache2 has 2 interfaces: internal yy.yy.yy.yy (for requests from HAProxy), and external IP zz.zz.zz.zz

Anytime I make requests outside the farm from one of the apache servers (such as a curl request in php to say, google.com), the REMOTE_ADDR header is the external IP of the apache server making the call (yy.yy.yy.yy or zz.zz.zz.zz).

The problem is, some of the servers I make such requests to limit the IPs requests from. Ideally I'd like to provide them the IP of the HAProxy server (x.x.x.x), instead of having to give them the IPs of the 2 backend servers.

Is there any way to accomplish this in configuring either apache or haproxy?

apache-2.2 ip haproxy

1 Answers

  1. Best Answer

    You must configure apache to send request via a proxy server. The easiest setup is to install squid on the haproxy machine and implement transparent proxy at your router/firewall.

    Assuming it's linux you can use this

    http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html

    If it's something else (cisco, checkpoint) they should all support similar setup.

    If you don't have access to the firewall/router you can implement the transparent proxy on the actual apache machines.

    • 1