4

I'm trying to setup a stunnel ssl farm load balanced by haproxy. It kinda looks like

haproxy -> many stunnels -> haproxy -> apache,nginx etc

Problem is to carry the original ip over to the final servers. It seems proxy-protocol is the perfect method but I have only been able to figure out how to send it from stunnel to haproxy

stunnel -> haproxy

when i put haproxy in tcp mode and use send-proxy towards the stunnel server, i geet ssl error

haproxy example:

frontend ssl_in
  bind 1.1.1.1:443
  mode tcp
  default_backend stunnel_srv

backend stunnel_srv
  mode tcp
  server 1.1.1.2:443 check send-proxy

stunnel config:

[https]
cert = /etc/stunnel/certs/test.examaple.org/fullchain.cer
key = /etc/stunnel/certs/test.example.org/private.key
accept = 1.1.1.2:443
connect = 1.1.1.3:8085
protocol = proxy
TIMEOUTclose = 0

Seems stunnel doesn't want to receive proxy-protocol headers and can only send them. any ideas of a magical option to achieve that?

Cheers

Johnny B
  • 51
  • 4

0 Answers0