Question 97925 in Nginx Question posted in
The official documentation can be found here.

Is there a way to configure nginx with OPTIONAL Proxy Protocol support?

Nginx can be configured to support the HAProxy proxy protocol for inbound traffic: http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_protocol

However, using proxy_protocol on;, nginx cannot handle HTTP(S) traffic without the PROXY line.

The traefik reverse proxy, on the other hand, is able to treat the PROXY line as optional:

If Proxy Protocol header parsing is enabled for the entry point, this entry point can accept connections with or without Proxy Protocol headers.
https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol

Is it possible to configure nginx to treat the PROXY line as optional?

My use case is nginx as a kubernetes ingress to handle proxy protocol traffic from outside via a load balancer and without the proxy protocol for cluster-internal HTTP(S) traffic.

I know there is hairpin-proxy that works, but it’s a bit hacky as it adds rewrites for all CoreDNS cluster-internal DNS entries.
https://github.com/compumike/hairpin-proxy#:~:text=Modify%20nginx%20to%20treat%20the%20PROXY%20line%20as%20optional

The K8s Cloud Setup used in this scenario:

Tags:

2

Answers


  1. 0

    Is it possible to configure nginx to treat the PROXY line as optional?

    No.

    You can use a listener with proxy protocol and one without but it’s currently not possible to use both in one listener.

    Login or Signup to reply.
  2. 0

    Proxy protocol specification forbids this kind of mixing of proxy and non-proxy connections. The reason is that it would allow easy spoofing of ip addresses and other data.

    Quote from the specification:

    The receiver MUST be configured to only receive the protocol described in this
specification and MUST not try to guess whether the protocol header is present
or not. This means that the protocol explicitly prevents port sharing between
public and private access. Otherwise it would open a major security breach by
allowing untrusted parties to spoof their connection addresses. The receiver
SHOULD ensure proper access filtering so that only trusted proxies are allowed
to use this protocol.
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search