Hello I'm trying to configure haproxy in transparent mode using the configuration below:
The backend servers have as default gateway the haproxy IP (172.17.232.232) frontend fe_frontend_pool_proxy_3128 timeout client 30m mode tcp bind 172.17.232.232:3128 transparent default_backend bk_pool_proxy_3128 backend bk_pool_proxy_3128 timeout server 30m timeout connect 5s mode tcp balance leastconn default-server inter 5s fall 3 rise 2 on-marked-down shutdown-sessions source 0.0.0.0 usesrc clientip server sibipd-wcg1 172.17.232.229:3128 check port 3128 inter 3s rise 3 fall 3 server romapd-wcg2 172.17.32.80:3128 check port 3128 backup inter 3s rise 3 fall 3 weight 10 source 0.0.0.0 option redispatch I have these iptables rules on the HAProxy server iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 111 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 111 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 This setup is working perfectly from any IP class other than 172.17.232.x. When I try to access the service from the same IP class with haproxy I see the packets having incorrect checksum . tcpdump -i eth0 -n host 172.17.232.229 and host 172.17.232.233 -vv tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 12:37:21.741935 IP (tos 0x0, ttl 64, id 63601, offset 0, flags [DF], proto TCP (6), length 60) 172.17.232.233.34012 > 172.17.232.229.3128: Flags [S], cksum 0x2a21 (incorrect -> 0xf5a2), seq 111508051, win 29200, options [mss 1460,sackOK,TS val 573276706 ecr 0,nop,wscale 7], length 0 12:37:21.743005 IP (tos 0x0, ttl 64, id 53770, offset 0, flags [DF], proto TCP (6), length 60) 172.17.232.233.34014 > 172.17.232.229.3128: Flags [S], cksum 0x2a21 (incorrect -> 0xdbe0), seq 1250971688, win 29200, options [mss 1460,sackOK,TS val 573276706 ecr 0,nop,wscale 7], length 0 What am I doing wrong? Thanks Marius
