Friday, 18 December 2009 19:31
Last Updated on Monday, 04 January 2010 19:35
Written by somer orbay
Hello,
This time i`m going to tell a very important tip about haproxy and nginx.
When you run a LB (Load Balancer) in front of any web server software (nginx, apache, etc...) the LB will send its ip address to the backend server so the server software (in my example thats nginx) will log the LB`s ip in the logs and within any application that does logging.
Whats the problem with that ?
Its very simple because we need to log the client`s ip address at the logs when they visit our site. In my case the geoip module was not functioning after i had installed the LB in front of two backend servers. (One server was having both LB and backend server and the other one was the second backend server, i used iptables port forwarding to have LB at the same ip on the first server).
So lets correct this problem
First things first
Correct the haproxy to send the x-forwarded-for header to the backend servers and close keep-alive.
Open haproxy.cfg and add the following at the global and listen section
option httpclose
option forwardfor
Now haproxy will send the x-forwarded-for header to the backend.
So haproxy is doing its job but how are we going to get the x-forwarded-for header information read by our backend server software, in my case thats nginx so i`ll talk about that here.
You need a special module for nginx and compile nginx again to have it added.
Thats nginx http real ip module
http://wiki.nginx.org/NginxHttpRealIpModule
Use --with-http_realip_module option while you configure the nginx.
When you finish installing the module then go to the corresponding vhost configuration file (example domain.conf) where you need to log the real client ip addresses from The LB.
set_real_ip_from load balancer ip address;
real_ip_header X-Forwarded-For;
The above will tell nginx to get x-forwarded-for header from haproxy on the specific ip so it`ll log and read the correct client ip addresses on the vhost.
Dont forget to restart nginx and haproxy after you make the changes.
For apache look for mod_extract or mod_rpaf.
Hope it helps you.
Thanks
