<div dir="ltr"><div><div><br></div>I have try it already before, <br></div><div><br></div><div>that's why for to make Zimbra's Nginx understand the proxy protocol which comes from HAProxy it must recompiled by new version (>= 1.9) as mailbox read header X-Forwarded-For from nginx<br></div><div><br></div><div>Here's to illustrate the traffic flow:<br></div><div><br></div><div>CLIENT ==> HAPROXY ==|proxy protocol|==> NGINX ==|X-Forwarded-For| ==> MAILBOX</div><div><br></div><div><br></div><div>for Zimbra's postfix it's already done with similar flow as i documented in <a href="https://iomarmochtar.wordpress.com/2017/11/21/using-haproxy-against-zimbra-mta-services-reveal-origin-ip/">https://iomarmochtar.wordpress.com/2017/11/21/using-haproxy-against-zimbra-mta-services-reveal-origin-ip/</a><br></div><div> </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 22, 2017 at 4:00 PM, Barry de Graaff <span dir="ltr"><<a href="mailto:info@barrydegraaff.tk" target="_blank">info@barrydegraaff.tk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div></div><div>No, it will not, but you need to pass on the external ip in oip</div><div><br></div><div><a href="https://github.com/Zimbra-Community/account-history#log-external-ip" target="_blank">https://github.com/Zimbra-<wbr>Community/account-history#log-<wbr>external-ip</a></div><div><br></div><div>You may also need to do this in haproxy,</div><div><br></div><div>Barry</div><div><div class="h5"><div><br>On 22 Dec 2017, at 09:53, Omar Mochtar <<a href="mailto:iomarmochtar@gmail.com" target="_blank">iomarmochtar@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="auto">If i implementing fail2ban or other blocking method in proxy or mailbox server it will blocking IP of HAproxy.</div><div class="gmail_extra"><br><div class="gmail_quote">On Dec 22, 2017 15:47, "Barry de Graaff" <<a href="mailto:info@barrydegraaff.tk" target="_blank">info@barrydegraaff.tk</a>> wrote:<br type="attribution"><blockquote class="m_6539533976147275305quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div></div><div>Perhaps use iptables and fail2ban...</div><div><br></div><div>Similar to</div><div><a href="https://github.com/Zimbra-Community/mailing-lists/wiki/DDOS-protection" target="_blank">https://github.com/Zimbra-Comm<wbr>unity/mailing-lists/wiki/DDOS-<wbr>protection</a></div><div><br></div><div>Why not use zimbra dosfilter?</div><font color="#888888"><div><br></div><div>Barry</div></font><div class="m_6539533976147275305elided-text"><div><br>On 22 Dec 2017, at 09:33, Omar Mochtar <<a href="mailto:iomarmochtar@gmail.com" target="_blank">iomarmochtar@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="auto"><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Yes, HAProxy is in front of zimbra MTA & proxy server, since it's a load balancer. </div><div dir="auto"><br></div><div dir="auto">What i found in HAproxy log file is just information of source & destinated server and it's very verbose because used in quite high client traffic so i cannot trace what source IP is (try) using X account just like in normal nginx.log without haproxy.</div><div dir="auto"><br></div><div dir="auto"><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Dec 22, 2017 15:13, "Barry de Graaff" <<a href="mailto:info@barrydegraaff.tk" target="_blank">info@barrydegraaff.tk</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div></div><div>Hello Omar,</div><div><br></div><div>I dunno, but isn\u2019t easier to just put haproxy in front of zimbra proxy and block all from there?</div><div><br></div><div>Barry</div><div><br>On 22 Dec 2017, at 08:47, Omar Mochtar <<a href="mailto:iomarmochtar@gmail.com" target="_blank">iomarmochtar@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div><div>Hi All, <br><br></div><div><br></div><div><br></div>Here's the background of the issue: I implemented HAProxy as Load Balancer for Zimbra MTA & Proxy (webmail, pop3, imap) services and it's running smoothly until we have brute force issue then when i want to block the source of brute force IP but it just shown HAProxy server's IP in the log files since the traffics are come from it. <br></div><div><br></div><div><br></div><div>After searching the solution is using HAProxy's Proxy Protocol that will add additional source information in package that will be forwarded to it's backend servers. For Postfix there is clear documentation in HaProxy's official blog (<a href="https://www.haproxy.com/blog/efficient-smtp-relay-infrastructure-with-postfix-and-load-balancers/" target="_blank">https://www.haproxy.com/blog/<wbr>efficient-smtp-relay-infrastru<wbr>cture-with-postfix-and-load-ba<wbr>lancers/</a>) and for the rest service (webmail, pop3, imap) which handled with Nginx the clue is only this documentation <a href="http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_protocol" target="_blank">http://nginx.org/en/docs/strea<wbr>m/ngx_stream_proxy_module.html<wbr>#proxy_protocol</a> . <br></div><div><br></div><div><br></div><div>Unfortunately nginx's proxy_protocol configuration is available from version 1.9.2 and Nginx version in Zimbra 8.7 is 1.7.1 .</div><div><br></div><div>The question is how to recompiling new version of Nginx (including it's zmlookup modules, etc) that will be replaced the existing one ?<br></div></div></div>
</div></blockquote></div></blockquote></div></div>
</div></blockquote></div></div></blockquote></div><br></div>
</div></blockquote></div></div></div></blockquote></div><br></div>