Proxy_protocol with crowdsec

[Railline]

Hi,

thank for your beautifull work, i have a little problem with my nginx when i try to use proxy protocol,
not from nginx it self but more on crowdsec

one image explain all

the ip display on the log is from my gateway docker i have enable proxy protocol on it and look to enable it on nginx but all request from nginx use the ip of my haproxy

i have search and i don't find the solution

thank for your help ^^

[Zoey2936]

Ca you please send me your advanced conf?

[Railline]

Yeah of course

default.conf

# ------------------------------------------------------------
# Default Site
# ------------------------------------------------------------
server {
    listen 0.0.0.0:80 proxy_protocol default_server;
    listen [::]:80 proxy_protocol default_server;

    listen 0.0.0.0:443 proxy_protocol ssl default_server;
    #listen [::]:443 proxy_protocol ssl default_server;

    listen 0.0.0.0:443 quic reuseport default_server;
    listen [::]:443 quic reuseport default_server;
    more_set_headers 'Alt-Svc: h3=":443"; ma=86400';

    real_ip_header proxy_protocol;

    server_name _;

    include conf.d/include/brotli.conf;
    include conf.d/include/force-tls.conf;
    include conf.d/include/tls-ciphers.conf;
    include conf.d/include/always.conf;

    ssl_certificate /data/tls/dummycert.pem;
    ssl_certificate_key /data/tls/dummykey.pem;
    #ssl_trusted_certificate ;

    location / {
        include conf.d/include/always.conf;
        root /html/default;
        try_files $uri /index.html;
    }
}

[Zoey2936]

sorry, no idea, are you sure that real_ip_header is correctly set?

[Zoey2936]

And maybe also haproxys config?

[Railline]

sure actually this is the configuration of Haproxy

global
    log stdout format raw local0

defaults
    log     global
    mode    tcp
    option  tcplog
    timeout connect 5000ms
    timeout client  300s
    timeout server  300s
    log-format "[%t] [IP_Src: %ci] [Port_Src: %cp] [Backend: %b] --> [Ip_Dest: %si] [Port_Dest: %sp] [Hostname: %H]"

frontend http_front
    bind *:2288
    default_backend NPM_http

frontend https_front
    bind *:2448
    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }
    use_backend vpn_backend if { req_ssl_sni -i vpn.mysecretdomain.no }
    default_backend NPM_https

backend vpn_backend
    server vpn_server 192.168.1.21:4443 check send-proxy-v2

backend NPM_http
    server nginx_manager_http 192.168.1.21:87 check send-proxy-v2

backend NPM_https
    server nginx_manager_https 192.168.1.21:4433 check send-proxy-v2

[Zoey2936]

sorry, I still had no time to look into this, it may take some weeks more

[Railline]

sorry, I still had no time to look into this, it may take some weeks more

No problem I still try to resolve it too

[Zoey2936]

I still had no time, but just for interest, did you maybe already found a solution?