0

I'm using AWS Network Load Balancer and I've enabled the "Proxy Protocol V2" in its Target Group. Connections are forwarded to some docker containers running nginx with this configuration:

server {
        listen 8080 proxy_protocol;
        set_real_ip_from 0.0.0.0/0;
        real_ip_header proxy_protocol;
        #...
}

Everything is working good but now I'd like to make those docker containers work locally, for a test environment. So, since I don't have an AWS NLB locally, I thought I would simulate its behavior using Apache http. Here's how I configured the Virtual Host, it has to support SSL.

<VirtualHost *:443>
    ServerAdmin mail@example.com
    DocumentRoot "G:/path"
    ServerName host.example.com
    SSLEngine on
    SSLCertificateFile "${SRVROOT}/conf/certs/host.crt"
    SSLCertificateKeyFile "${SRVROOT}/conf/certs/host.key"
    ProxyPass / balancer://mycluster/
    <Proxy "balancer://mycluster">
        BalancerMember "http://localhost:8117"
    </Proxy>
</VirtualHost>

Sadly this is not working. I think that's because Apache http is not "speaking the Proxy protocol" to the BalanceMember. When I try to make a request, I get this error.

<body>
    <h1>Proxy Error</h1>
    <p>The proxy server received an invalid
        response from an upstream server.<br />
The proxy server could not handle the request<p>Reason: <strong>Error reading from remote server</strong></p>
    </p>
</body>

The error log reports these two lines

[Mon Jun 08 13:19:43.324809 2020] [proxy_http:error] [pid 17460:tid 1164] (20014)Internal error (specific information not available): [client 127.0.0.1:51817] AH01102: error reading status line from remote server localhost:8117
[Mon Jun 08 13:19:43.324809 2020] [proxy:error] [pid 17460:tid 1164] [client 127.0.0.1:51817] AH00898: Error reading from remote server returned by /

Is it possibile to simulare a NLB using Apache httpd? Should I just give up and use HAProxy instead? Thanks

MorenoGentili
  • 1

1 Answers1

0

Afaik proxy protocol support for Apache HTTPD is found through a third party module.

You can check all about it here: mod_proxy_protocol doc and here: mod_proxy_protocol github page

Explanation there is quite easy, load module first, enable the proxy protocol through directive:

ProxyProtocol on
ezra-s
  • 2,215
  • 1
  • 7
  • 13
  • Thanks for your answer but this is for the SERVER side, e.g. the party that will READ the proxy protocol header. Instead I need to enable in on the client side, i.e. Apache should be writing the proxy protocol header. – MorenoGentili Jun 10 '20 at 15:56