INTERNAL And the fact that I have tried both send-proxy and send-proxy-v2 and get the same error in both cases tells me that the problem is not likely to be THAT actual proxy setting but something which adding proxy does different than just sending traffic through. I am aware that the header is changed and ( at least) the source IP address is added.
From: Илья Шипицин <[email protected]> Sent: Thursday, June 18, 2026 3:50 PM To: Marc Hoppins <[email protected]> Cc: [email protected] Subject: Re: [SPAM] Re: [EXT]Re: HAProxy and Percona [External Sender] no, I mean "send-proxy" instead of "send-proxy-v2" it is good sign that servers are green чт, 18 июн. 2026 г. в 15:44, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL Servers are up according to stat (and WSREP in mysql). Without proxy settings in HAP and Percona traffic to DB appears as if from proxy. With proxy settings traffic does not appear so the problem must be proxy setting in HAP and/or Percona. It is possible that proxy setting on HAP may be using something different than it does for non-proxy traffic. From: Илья Шипицин <[email protected]<mailto:[email protected]>> Sent: Thursday, June 18, 2026 3:27 PM To: Marc Hoppins <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: Re: [SPAM] Re: [EXT]Re: HAProxy and Percona [External Sender] not sure about v2, do not have percona server around to check. what else comes to mind, do you have "stat" enabled ? something like that (prometheus is optional). it will allow you to see whether haproxy is thinking servers are up or down (as you have health checks enabled) frontend stats mode http bind 0.0.0.0:8404<http://0.0.0.0:8404> http-request use-service prometheus-exporter if { path /metrics } stats enable stats uri /stats stats refresh 10s чт, 18 июн. 2026 г. в 14:56, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL I just tried proxy-v2 and still got the same errors (prod) marc.hoppins.ipa@d2-hmaster01:~<mailto:[email protected]:~> $ mysql -h d2-haproxy02 -P 3306 -u march -p -e "select customerNumber,customerName,city,country,creditLimit from classicmodels.customers limit 20;" Enter password: ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL routines::wrong version number (prod) marc.hoppins.ipa@d2-hmaster01:~<mailto:marc.hoppins.ipa@d2-hmaster01:~> $ mysql -h d2-haproxy02 -P 3306 -u march -p --ssl-mode=DISABLED -e "SELECT 1;" Enter password: ERROR 2013 (HY000): Lost connection to MySQL server during query From: Илья Шипицин <[email protected]<mailto:[email protected]>> Sent: Thursday, June 18, 2026 2:02 PM To: Marc Hoppins <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: [SPAM] Re: [EXT]Re: HAProxy and Percona [External Sender] I've checked my config, I also use "send-proxy-v2" on "server" lines backend bk_vpn mode tcp server server-vpn 192.168.1.10:1443<http://192.168.1.10:1443> send-proxy-v2 not sure which proxy protocol version is supported by percona, I mean those lines: server d2-db-node01 xx.xx.140.45:3306 server d2-db-node02 xx.xx.140.46:3306 backup server d2-db-node03 xx.xx.140.47:3306 backup чт, 18 июн. 2026 г. в 13:56, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL It is claimed to exist and there is a setting for it. /etc/mysql/percona-xtradb-cluster.conf.d/mysqld.cnf [mysqld] proxy_protocol_networks="10.99.140.0/22<http://10.99.140.0/22>" From: Илья Шипицин <[email protected]<mailto:[email protected]>> Sent: Thursday, June 18, 2026 10:51 AM To: Marc Hoppins <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: [EXT]Re: HAProxy and Percona [External Sender] you are trying to pass connection to mysql using so called "proxy protocol" it is super thing preserving original ip address however, I'm not sure "proxy protocol" listen is available for mysql. at least, I could find one ср, 17 июн. 2026 г. в 14:08, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL Hi, I am trying to get source IP recognition sorted to a percona cluster. Following a directive to configure the proxy/percona setup to correctly identify client operations by source address, I reconfigured percona backends with send-proxy. I now have: source-host - proxy-node - percona node (8.4.7) I installed mysql. If I connect to source to proxy-node:3306 I get:- ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL routines::wrong version number I did try (from source) openssl s_client and gave path to the directory where our certificates are. It is the same path on all installed hosts companywide and contains the same base certificates, including our own self-signed one(s). I do see verify error:num=19:self-signed certificate in certificate chain from the output but I am reluctant to admit this is the cause. I did try removing (commenting out) the ssl bind options fro HAproxy config and restarting but the same error (ERROR 2026) appears. I can find no 8.4.7 client from percona. HAPROXY for the front/back defaults pxc_d2 log global mode tcp option tcplog option dontlognull retries 3 timeout connect 10s timeout client 1h timeout server 1h frontend pxc-d2-frontend from pxc_d2 bind *:3306 use_backend pxc-d2-backend backend pxc-d2-backend from pxc_d2 default-server inter 1001 rise 3 fall 3 on-marked-down shutdown-sessions default-server port 9200 check send-proxy balance roundrobin server d2-db-node01 xx.xx.140.45:3306 server d2-db-node02 xx.xx.140.46:3306 backup server d2-db-node03 xx.xx.140.47:3306 backup Where would I see any access attempts from client to target? The haproxy.log shows nothing, only regular Zabbix connections. Initially I contacted percona thinking that it was a problem with TLS/SSL and their interactions may be seen here https://forums.percona.com/t/connecting-to-database-through-haproxy/40920 Any ideas would be helpful. Marc
