PROXY Protocol support lets MDaemon sit behind a load balancer or reverse proxy, such as HAProxy, and still see the true IP address of the original client, instead of the proxy's own IP address. MDaemon automatically detects and supports both the text-based PROXY Protocol version 1 and the binary version 2 formats used by HAProxy and compatible proxies. PROXY Protocol support is a global option (it cannot be configured per domain) and changes take effect immediately for new connections when enabled.
Configuration
Enable PROXY Protocol
Check this box to turn on PROXY Protocol support for every SMTP and HTTP listening port. Connections that come from any trusted proxy IP addresses designated below will be required to use the PROXY Protocol immediately after the TCP connection is opened. If the proxy header is not sent immediately, the connection will not be allowed to proceed. Connections from other IPs aren't allowed to use the PROXY Protocol, and are treated as normal, direct connections.
Require Proxy protocol from these IPs
Connections from these IP addresses are required to send a PROXY Protocol header.
|
If MDaemon detects data on the socket that looks like a PROXY Protocol header but the connection did not come from an IP on the list, it logs a warning to the System Log rather than acting on the header. If you see this warning, it usually means either a new load balancer or proxy IP needs to be added to the trusted list, or that something is sending a forged PROXY header in an attempt to spoof its source address — both are worth investigating. |
Add
Enter the IP address of a proxy or load balancer that will be forwarding connections to MDaemon, then click Add to add it to the list. Each entry must be a single, valid IPv4 or IPv6 address — address masks, wildcards, and CIDR ranges are not supported here.
Delete
Select one or more entries in the PROXY protocol IPs list and click Delete to remove them.
