{"action":"created","issue":{"url":"https://api.github.com/repos/UlricE/pen/issues/15","labels_url":"https://api.github.com/repos/UlricE/pen/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/UlricE/pen/issues/15/comments","events_url":"https://api.github.com/repos/UlricE/pen/issues/15/events","html_url":"https://github.com/UlricE/pen/issues/15","id":104670854,"number":15,"title":"Transparent Reverse Proxy on Centos6/7 is showing the load balancer IP in the source address","user":{"login":"ankush-grover-3pg","id":6574295,"avatar_url":"https://avatars.githubusercontent.com/u/6574295?v=3","gravatar_id":"","url":"https://api.github.com/users/ankush-grover-3pg","html_url":"https://github.com/ankush-grover-3pg","followers_url":"https://api.github.com/users/ankush-grover-3pg/followers","following_url":"https://api.github.com/users/ankush-grover-3pg/following{/other_user}","gists_url":"https://api.github.com/users/ankush-grover-3pg/gists{/gist_id}","starred_url":"https://api.github.com/users/ankush-grover-3pg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ankush-grover-3pg/subscriptions","organizations_url":"https://api.github.com/users/ankush-grover-3pg/orgs","repos_url":"https://api.github.com/users/ankush-grover-3pg/repos","events_url":"https://api.github.com/users/ankush-grover-3pg/events{/privacy}","received_events_url":"https://api.github.com/users/ankush-grover-3pg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-03T11:23:42Z","updated_at":"2015-09-03T11:54:15Z","closed_at":null,"body":"Hi,\r\n\r\nI have followed the below page for setting the transparent reverse proxy on Centos6/7 but in the logs I am still seeing the Load Balancer IP. Actually I am trying to setup graylog2 (log analyzer) with the multiple servers and for architecture I need a LB which can run forward the request to the different graylog servers. \r\n\r\nhttps://github.com/UlricE/pen/wiki/Transparent-Reverse-Proxy\r\n\r\nPresently only 1 graylog server is running and accepting tcp connections on port 21514 ports and the pen lb is running on port 22514 on the same host. A few syslog clients (linux machines) are forwarding their logs on to pen lb port 22514 and which in turn forwarding to to port 21514 of graylog server. In the graylog servers I see the logs are coming with the source ip of lb whereas pen is configured to run in the transparent environment. I have tried pen in transparent mode both with the rpm (epel repo) and building it from source and in both the cases lb ip is coming as the source ip. The issue is on Centos 6 as well as on Centos 7.\r\n\r\nWhat could be the reason for transparent reverse proxy not working properly. I have pasted the pen configuration file, startup script (with transparent option) and logs of pen\r\n\r\npen.conf file\r\n\r\nLOGFILE=/var/log/pen.log\r\nWEBFILE=/var/www/html/pen/webstats.html\r\nCONTROL=172.31.10.58:10080\r\nMAX_CONNECTIONS=500\r\nPORT=22514\r\nBACKEND=2\r\nSERVER0=172.31.10.59:21514\r\nSERVER1=172.31.10.58:21514\r\n\r\n/etc/init.d/pend file (startup control file)\r\n\r\n#!/bin/bash\r\n\r\n# pend: Start/Stop Pend\r\n# chkconfig: - 90 10\r\n# description: Pen is a light weight simple load balancer.\r\n# pidfile: /var/run/pen.pid\r\n\r\n. /etc/rc.d/init.d/functions\r\n. /etc/sysconfig/network\r\n. /etc/pen.conf\r\n\r\nLOCKFILE=\"/var/lock/subsys/pen\"\r\nPID=/var/run/pen.pid\r\nPROG=/usr/bin/pen\r\n\r\nRETVAL=0\r\nstart() {\r\n   echo -n $\"Starting Pend: \"\r\n   SERVER=`grep \"^SERVER\" /etc/pen.conf | cut -d= -f2`\r\n   daemon $PROG -w $WEBFILE -x $MAX_CONNECTIONS -p $PID -l $LOGFILE -C $CONTROL -S $BACKEND -r $PORT $SERVER -o transparent -d\r\n   RETVAL=$?\r\n   echo\r\n   [ $RETVAL -eq 0 ] && touch $LOCKFILE\r\n   return $RETVAL\r\n}\r\nstop() {\r\n   echo -n $\"Stopping Pend: \"\r\n   killproc $PROG\r\n   RETVAL=$?\r\n   echo\r\n   [ $RETVAL -eq 0 ] && rm -f $PID $LOCKFILE\r\n   return $RETVAL\r\n}\r\ncase \"$1\" in\r\n   start)\r\n      start\r\n      ;;\r\n   stop)\r\n      stop\r\n      ;;\r\n   status)\r\n      status pend\r\n      ;;\r\n   restart)\r\n      stop\r\n      start\r\n      ;;\r\n   *)\r\n      echo $\"Usage: $0 {start|stop|status|restart}\"\r\n      exit 1\r\nesac\r\nexit $?\r\n\r\nIptables rules for mangle table\r\n\r\niptables -t mangle -L\r\nChain PREROUTING (policy ACCEPT)\r\ntarget     prot opt source               destination         \r\nDIVERT     tcp  --  anywhere             anywhere             socket\r\n\r\nChain INPUT (policy ACCEPT)\r\ntarget     prot opt source               destination         \r\n\r\nChain FORWARD (policy ACCEPT)\r\ntarget     prot opt source               destination         \r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget     prot opt source               destination         \r\n\r\nChain POSTROUTING (policy ACCEPT)\r\ntarget     prot opt source               destination         \r\n\r\nChain DIVERT (1 references)\r\ntarget     prot opt source               destination         \r\nMARK       all  --  anywhere             anywhere             MARK set 0x1\r\nACCEPT     all  --  anywhere             anywhere            \r\n\r\n\r\nLogs file\r\n\r\n172.32.1063 1441278230 172.31.10.59 0 2015-09-03T07:03:50.947734-04:00 jiraca-test rsyslogd -  [origin software=\"rsyslogd\" swVersion=\"7.\r\n172.32.1063 1441278248 172.31.10.59 0 2015-09-03T07:04:08.189846-04:00 jiraca-test xinetd 24232 START: nrpe pid=24440 from=::ffff:172.16\r\n172.32.1063 1441278248 172.31.10.59 0 2015-09-03T07:04:08.204888-04:00 jiraca-test xinetd 24232 EXIT: nrpe status=0 pid=24440 duration=0\r\n172.32.1063 1441278250 172.31.10.59 0 2015-09-03T07:04:10.239426-04:00 jiraca-test sshd 24444 Failed password for root from 172.31.10.28\r\n172.32.1063 1441278250 172.31.10.59 0 2015-09-03T07:04:10.437364-04:00 jiraca-test sshd 24444 Failed password for root from 172.31.10.28\r\n172.32.1063 1441278250 172.31.10.59 0 2015-09-03T07:04:10.438355-04:00 jiraca-test sshd 24444 Connection closed by 172.31.10.28 [preauth\r\n172.32.1063 1441278250 172.31.10.59 0 2015-09-03T07:04:10.777407-04:00 jiraca-test sshd 24446 Failed password for root from 172.31.10.28\r\n172.32.1063 1441278250 172.31.10.59 0 2015-09-03T07:04:10.953666-04:00 jiraca-test sshd 24446 Failed password for root from 172.31.10.28\r\n172.32.1063 1441278250 172.31.10.59 0 2015-09-03T07:04:10.954467-04:00 jiraca-test sshd 24446 Connection closed by 172.31.10.28 [preauth\r\n172.32.1063 1441278251 172.31.10.59 0 2015-09-03T07:04:11.291114-04:00 jiraca-test sshd 24448 Failed password for root from 172.31.10.28\r\n\r\nThanks & Regards\r\n\r\nAnkush Grover\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/UlricE/pen/issues/comments/137416039","html_url":"https://github.com/UlricE/pen/issues/15#issuecomment-137416039","issue_url":"https://api.github.com/repos/UlricE/pen/issues/15","id":137416039,"user":{"login":"UlricE","id":6648630,"avatar_url":"https://avatars.githubusercontent.com/u/6648630?v=3","gravatar_id":"","url":"https://api.github.com/users/UlricE","html_url":"https://github.com/UlricE","followers_url":"https://api.github.com/users/UlricE/followers","following_url":"https://api.github.com/users/UlricE/following{/other_user}","gists_url":"https://api.github.com/users/UlricE/gists{/gist_id}","starred_url":"https://api.github.com/users/UlricE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/UlricE/subscriptions","organizations_url":"https://api.github.com/users/UlricE/orgs","repos_url":"https://api.github.com/users/UlricE/repos","events_url":"https://api.github.com/users/UlricE/events{/privacy}","received_events_url":"https://api.github.com/users/UlricE/received_events","type":"User","site_admin":false},"created_at":"2015-09-03T11:54:15Z","updated_at":"2015-09-03T11:54:15Z","body":"Do you have one or two network interfaces in the Pen host? It looks as though the client and servers are on the same network segment. The Wiki page isn't very explicit but the relevant section is this:\r\n\r\n> In this example, debian2 is the client with IP 192.168.100.2 and debian3 is the server with IP 192.168.101.3. Pen sits in between with IP addresses 192.168.100.11 and 192.168.101.10. Debian2 and debian3 have static routes set up so they can reach each other through the host running Pen.\r\n\r\nThis is to force the return traffic through Pen so the \"spoofed\" addresses can be unspoofed."}}