PROXY protocol support lets SecurityGateway sit behind a load balancer or reverse proxy, such as HAProxy, and still see the true IP address of the original client, instead of the proxy's own IP address. SecurityGateway automatically detects and supports both the text-based PROXY protocol version 1 and the binary version 2 formats used by HAProxy and compatible proxies. PROXY Protocol support is a global option (it cannot be configured per domain) and changes take effect immediately for new connections when enabled.
Configuration
Enable PROXY protocol on all SMTP and HTTP ports
Check this box to turn on PROXY protocol support for every SMTP and HTTP listening port. Connections that come from any trusted proxy IP addresses designated below will be required to use the PROXY protocol immediately after the TCP connection is opened. If the proxy header is not sent immediately, the connection will not be allowed to proceed. Connections from other IPs aren't allowed to use the PROXY protocol, and are treated as normal, direct connections.
Trusted Proxy IP Addresses
List your trusted proxy IP addresses here. Connections from these IP addresses are required to send a PROXY protocol header. The only exception to this is localhost. When localhost is added to the Trusted Proxy IP Address list, using the PROXY protocol is optional for localhost connections.
|
If SecurityGateway detects data on the socket that looks like a PROXY protocol header but the connection did not come from an IP on the trusted list, it logs a warning to the System Log rather than acting on the header. If you see this warning, it usually means either a new load balancer or proxy IP needs to be added to the trusted list, or that something is sending a forged PROXY header in an attempt to spoof its source address — both are worth investigating. |
Add
Enter the IP address of a proxy or load balancer that will be forwarding connections to SecurityGateway, then click Add to add it to the list. Each entry must be a single, valid IPv4 or IPv6 address — address masks, wildcards, and CIDR ranges are not supported here.
Remove
Select one or more entries in the Trusted Proxy IP Addresses list and click Remove to delete them.
