HAproxy and client IP

[Varazir]

Hello,

I have HA proxy in front of Domoticz for SSL offloading.
I can't get Domoticz see the client IP.

I did a tcpdump and checked the output in wireshark.

I can see this.

[gizmocuz]

Did you add your HAproxy IP Address in the "Trusted Networks" under Settings?

[Varazir]

Did you add your HAproxy IP Address in the "Trusted Networks" under Settings?

No, I don't want that at the moment. As even if you access domoticz external you will get the HAproxy IP

[viralkuinfo7]

thanks very much

[Varazir]

Anyone that can help out here ?

[kiddigital]

Did you add your HAproxy IP Address in the "Trusted Networks" under Settings?

No, I don't want that at the moment. As even if you access domoticz external you will get the HAproxy IP

I think you want that
Domoticz needs to know if it can trust Proxy headers it receives. Otherwise anyone can pretend to be a proxy.
So when you add the Proxy IP address to the trusted network, domoticz will process the proxy headers. And with the proper proxy headers it will also see the real client IP and act accordingly.

[Varazir]

Did you add your HAproxy IP Address in the "Trusted Networks" under Settings?

No, I don't want that at the moment. As even if you access domoticz external you will get the HAproxy IP

I think you want that
Domoticz needs to know if it can trust Proxy headers it receives. Otherwise anyone can pretend to be a proxy.
So when you add the Proxy IP address to the trusted network, domoticz will process the proxy headers. And with the proper proxy headers it will also see the real client IP and act accordingly.

You are talking about "Trusted Networks (no username/password):" I don't wan't to set my proxy adress then everyone just bypass logon...

[janpep]

You are talking about "Trusted Networks (no username/password):" I don't wan't to set my proxy adress then everyone just bypass logon...

Did you test that or do you think that?
Domoticz is connected by the ip adress of the proxy, but it should see the remote addres (that is forwarded by the proxy if headers are set right), so that should not be the case.

[kiddigital]

No, I don't want that at the moment. As even if you access domoticz external you will get the HAproxy IP

I think you want that
Domoticz needs to know if it can trust Proxy headers it receives. Otherwise anyone can pretend to be a proxy.
So when you add the Proxy IP address to the trusted network, domoticz will process the proxy headers. And with the proper proxy headers it will also see the real client IP and act accordingly.

You are talking about "Trusted Networks (no username/password):" I don't wan't to set my proxy adress then everyone just bypass logon...

When you add the Proxy IP to the Trusted list, it does NOT mean everyone will bypass the login. Give it a try and test it (I assume you are using a recent version of Domoticz).
The users that want to access domoticz through your Proxy will be checked against their real IP address and NOT the Proxy IP.
Try and test!