- 6
- 2
Last edited:
I have an OPNsense instance as my network router/firewall. For more security, on top of this, I have installed the HAProxy plugin to abstract webtraffic for all of my backend web-instances.
One of those backend web-instances is my Synology NAS, serving a couple of webservices reachable from the internet (e.g. Synology Drive, Synology Photos, etc.).
Now with HAProxy running as the frontend, the Synology NAS can only "see" the HAProxy IP address which makes the Synology Geo-IP/Autoblocking function useless as it would never be able to block public IP addresses.
To solve this problem I have read about the HAProxy X-Forwarded-For header setting which forwards the original IP address trying to establish a connection. I have configured it like this in my HAProxy frontend:
HAProxy indeed accepts the syntax but still the Synology NAS only sees the IP address of the HAProxy instead of public IP addresses trying to connect to the NAS.
FYI: According to the official HAProxy documentation it should not matter if those forwarders are configured on the HAProxy's frontend or backend side.
Is anyone here with the same setup or with according knowledge who can help me out with this?
One of those backend web-instances is my Synology NAS, serving a couple of webservices reachable from the internet (e.g. Synology Drive, Synology Photos, etc.).
Now with HAProxy running as the frontend, the Synology NAS can only "see" the HAProxy IP address which makes the Synology Geo-IP/Autoblocking function useless as it would never be able to block public IP addresses.
To solve this problem I have read about the HAProxy X-Forwarded-For header setting which forwards the original IP address trying to establish a connection. I have configured it like this in my HAProxy frontend:
Code:
# add X-FORWARDED-FOR
option forwardfor
# add X-CLIENT-IP
http-request add-header X-CLIENT-IP %[src]
FYI: According to the official HAProxy documentation it should not matter if those forwarders are configured on the HAProxy's frontend or backend side.
Is anyone here with the same setup or with according knowledge who can help me out with this?