Re: HAProxy and proxy protocol support
Pascal Véron <[email protected]> Mon, 10 Jun 2024 15:40:17 +0200
| Newsgroups | gmane.mail.imap.courier.general |
|---|---|
| Message-ID | <[email protected]> |
Thank for your response, If you are interested, I can propose my help at least for testing and reporting Cordialement, Pascal Véron VEZIM SARL Le 10/06/2024 à 14:17, Sam Varshavchik a écrit : > Pascal Véron writes: > >> « HTML content follows >> »Hello, >> >> We installed 2 Courier servers in different datacenter behind a load >> balancer provided by our hosting provider (OVHCloud). >> This load balancer are using HAproxy technology and proxy protocol. >> >> If we use load balancer without proxy protocol, all works well for >> clients. SMTP, IMAP and POP connexions are fully fonctionnals. But >> there a problem we can't solve. Courier server receive only load >> balancer's IP instead of real origin IP (which is the one we want to >> have for logs, fail2ban, blacklists check...) >> >> HAProxy provide some proxy protocol (v1, v2, v2-ssl...) to transmit >> origin IP, but if we use proxy protocol on load balancer, it does not >> work >> >> > telnet [IP_LOAD_BALANCER] 587 >> Trying [IP_LOAD_BALANCER]... >> Connected to [IP_LOAD_BALANCER]. >> Escape character is '^]'. >> 220 [NAME_LOAD_BALANCER] ESMTP >> 502 ESMTP command error >> ...write in mail.log >> >> Jun 10 10:19:28 [NAME_LOAD_BALANCER]: >> error,relay=::ffff:10.110.97.193,port=29832,msg="502 ESMTP command >> error",cmd: PROXY TCP4 [REAL_IP_ORIGIN] [IP_LOAD_BALANCER] 56590 587 >> >> Same with pop >> >> > telnet [IP_LOAD_BALANCER] 110 >> Trying [IP_LOAD_BALANCER]... >> Connected to [IP_LOAD_BALANCER]. >> Escape character is '^]'. >> +OK Hello there. >> -ERR Invalid command. >> >> So sadly as it stands we cannot use this system. >> >> So my question is : do you think this could be an interesting option >> to add to Courier or not ? >> >> <URL:https://github.com/haproxy/haproxy/blob/master/doc/proxy-protocol.txt>https://github.com/haproxy/haproxy/blob/master/doc/proxy-protocol.txt >> >> <URL:https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address>https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address >> > > At least version 1 looks simple enough to handle, however I don't use > HAProxy myself, so this would be a hit or miss proposition, as far as > testing goes. > > > > > _______________________________________________ > courier-users mailing list > [email protected] > Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users _______________________________________________ courier-users mailing list [email protected] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users