Standard Kernel builds don’t support TPROXY ( 2.6.28 does now!).
For example if you use HaProxy as the load balancer then all of the backend servers see the traffic coming from the IP address of the load balancer. TPROXY allows you to make sure the backend servers see the true client IP address in the logs.
Ps. An easier alternative is inserting the clients ip in the x-forwarded-for header (option forwardfor).
For TPROXY to work you need three things:
1) TPROXY compiled into the linux kernel
2) TPROXY / Socket compiled into netfilter / iptables (due in v1.4.3?)
3) HaProxy compiled with the USE_LINUX_TPROXY option
The TPROXY patch for Linux Kernel 220.127.116.11 is here:
The following is a guide how to install on Centos 5.1:
Read the rest of this entry »