INTERNAL I managed to get this out of the general_log. I am unable to determine if the proxy sent incorrect session information or the percona just refuses to accept it.
15:21:20.281473 IP CLIENT.55386 > PROXY.mysql: Flags [S], seq 961108031, win 64240, options [mss 1460,sackOK,TS val 1993410093 ecr 0,nop,wscale 7], length 0 15:21:20.281506 IP PROXY.mysql > CLIENT.55386: Flags [S.], seq 3122485353, ack 961108032, win 65160, options [mss 1460,sackOK,TS val 1385581826 ecr 1993410093,nop,wscale 7], length 0 15:21:20.281575 IP CLIENT.55386 > PROXY.mysql: Flags [.], ack 1, win 502, options [nop,nop,TS val 1993410093 ecr 1385581826], length 0 15:21:20.281695 IP PROXY.32826 > PERCONA.mysql: Flags [S], seq 1728864001, win 64240, options [mss 1460,sackOK,TS val 970964879 ecr 0,nop,wscale 7], length 0 15:21:20.281853 IP PERCONA.mysql > PROXY.32826: Flags [S.], seq 2520953573, ack 1728864002, win 65160, options [mss 1460,sackOK,TS val 1621205428 ecr 970964879,nop,wscale 7], length 0 15:21:20.281865 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 1, win 502, options [nop,nop,TS val 970964879 ecr 1621205428], length 0 15:21:20.281884 IP PROXY.32826 > PERCONA.mysql: Flags [P.], seq 1:50, ack 1, win 502, options [nop,nop,TS val 970964879 ecr 1621205428], length 49 15:21:20.281968 IP PERCONA.mysql > PROXY.32826: Flags [.], ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0 15:21:20.282196 IP PERCONA.mysql > PROXY.32826: Flags [P.], seq 1:82, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 81 15:21:20.282200 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 82, win 502, options [nop,nop,TS val 970964879 ecr 1621205429], length 0 15:21:20.282214 IP PROXY.mysql > CLIENT.55386: Flags [P.], seq 1:82, ack 1, win 510, options [nop,nop,TS val 1385581826 ecr 1993410093], length 81 15:21:20.282222 IP PERCONA.mysql > PROXY.32826: Flags [P.], seq 82:119, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 37 15:21:20.282225 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 119, win 502, options [nop,nop,TS val 970964879 ecr 1621205429], length 0 15:21:20.282230 IP PERCONA.mysql > PROXY.32826: Flags [F.], seq 119, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0 15:21:20.282232 IP PERCONA.mysql > PROXY.32826: Flags [R.], seq 120, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0 15:21:20.282246 IP PROXY.mysql > CLIENT.55386: Flags [F.], seq 82:119, ack 1, win 510, options [nop,nop,TS val 1385581826 ecr 1993410093], length 37 15:21:20.282254 IP CLIENT.55386 > PROXY.mysql: Flags [.], ack 82, win 502, options [nop,nop,TS val 1993410094 ecr 1385581826], length 0 15:21:20.282261 IP PERCONA.mysql > PROXY.32826: Flags [R], seq 2520953655, win 0, length 0 15:21:20.282273 IP PERCONA.mysql > PROXY.32826: Flags [R], seq 2520953692, win 0, length 0 15:21:20.282277 IP CLIENT.55386 > PROXY.mysql: Flags [P.], seq 1:37, ack 82, win 502, options [nop,nop,TS val 1993410094 ecr 1385581826], length 36 15:21:20.282285 IP PROXY.mysql > CLIENT.55386: Flags [.], ack 37, win 510, options [nop,nop,TS val 1385581826 ecr 1993410094], length 0 15:21:20.301595 IP CLIENT.55386 > PROXY.mysql: Flags [P.], seq 37:359, ack 120, win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 322 15:21:20.301605 IP PROXY.mysql > CLIENT.55386: Flags [R], seq 3122485473, win 0, length 0 15:21:20.301614 IP CLIENT.55386 > PROXY.mysql: Flags [F.], seq 359, ack 120, win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 0 15:21:20.301619 IP PROXY.mysql > CLIENT.55386: Flags [R], seq 3122485473, win 0, length 0 15:21:20.301623 IP CLIENT.55386 > PROXY.mysql: Flags [R.], seq 360, ack 120, win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 0 From: Илья Шипицин <[email protected]> Sent: Thursday, June 18, 2026 4:00 PM To: Marc Hoppins <[email protected]> Cc: [email protected] Subject: [EXT]Re: HAProxy and Percona [External Sender] as a naive guess, maybe adding " mode tcp" to frontend will help (you have that in "default" and likely it should be inherited, but I specify explicitly) ср, 17 июн. 2026 г. в 14:08, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL Hi, I am trying to get source IP recognition sorted to a percona cluster. Following a directive to configure the proxy/percona setup to correctly identify client operations by source address, I reconfigured percona backends with send-proxy. I now have: source-host - proxy-node - percona node (8.4.7) I installed mysql. If I connect to source to proxy-node:3306 I get:- ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL routines::wrong version number I did try (from source) openssl s_client and gave path to the directory where our certificates are. It is the same path on all installed hosts companywide and contains the same base certificates, including our own self-signed one(s). I do see verify error:num=19:self-signed certificate in certificate chain from the output but I am reluctant to admit this is the cause. I did try removing (commenting out) the ssl bind options fro HAproxy config and restarting but the same error (ERROR 2026) appears. I can find no 8.4.7 client from percona. HAPROXY for the front/back defaults pxc_d2 log global mode tcp option tcplog option dontlognull retries 3 timeout connect 10s timeout client 1h timeout server 1h frontend pxc-d2-frontend from pxc_d2 bind *:3306 use_backend pxc-d2-backend backend pxc-d2-backend from pxc_d2 default-server inter 1001 rise 3 fall 3 on-marked-down shutdown-sessions default-server port 9200 check send-proxy balance roundrobin server d2-db-node01 xx.xx.140.45:3306 server d2-db-node02 xx.xx.140.46:3306 backup server d2-db-node03 xx.xx.140.47:3306 backup Where would I see any access attempts from client to target? The haproxy.log shows nothing, only regular Zabbix connections. Initially I contacted percona thinking that it was a problem with TLS/SSL and their interactions may be seen here https://forums.percona.com/t/connecting-to-database-through-haproxy/40920 Any ideas would be helpful. Marc
