mod_proxy_protocol Implements the server side of the proxy protocol. Extension mod_proxy_protocol.c proxy_protocol_module

mod_proxy_protocol implements the server side of HAProxy's Proxy Protocol.

The module overrides the client IP address for the connection with the information supplied by the upstream proxy in the proxy protocol (connection) header.

This overridden useragent IP address is then used for the mod_authz_host Require ip feature, is reported by mod_status, and is recorded by mod_log_config %a and core %a format strings. The underlying client IP of the connection is available in the %{c}a format string.

It is critical to only enable this behavior from intermediate proxies which are trusted by this server, since it is trivial for the remote client to impersonate another client. Currently this must be done by external means (such as a firewall) as this module does not (yet) implement access controls.

Proxy Protocol Spec ProxyProtocol Enable or disable the proxy protocol handling ProxyProtocol On|Off server configvirtual host

The ProxyProtocol enables or disables the reading and handling of the proxy protocol connection header. If enabled the upstream client must send the header every time it opens a connection or the connection will get aborted.

While this directive may be specified in any virtual host, it is important to understand that because the proxy protocol is connection based and protocol agnostic, the enabling and disabling is actually based on ip-address and port. This means that if you have multiple name-based virtual hosts for the same host and port, and you enable it any one of them, then it is enabled for all them (with that host and port). It also means that if you attempt to enable the proxy protocol in one and disable in the other, that won't work; in such a case the last one wins and a notice will be logged indicating which setting was being overridden.

ProxyProtocol On