Source IP is lost when Praxis terminates and re-originates TCP connections. In multi-tier proxy deployments (external LB -> Praxis -> backend), the backend sees Praxis's IP instead of the client's.
PROXY protocol is the standard mechanism for source IP preservation in proxy-mode deployments (HAProxy spec, widely adopted by Nginx, Envoy, AWS NLB, etc.).
Goal
Preserve client source IP across proxy tiers using PROXY protocol v1 (text) and v2 (binary).
Requirements
- Inbound: parse PROXY protocol v1/v2 headers from downstream connections on a per-listener opt-in basis
- Outbound: prepend PROXY protocol headers when forwarding to upstreams, configurable per-cluster
- Expose original client address to filters, access logging, and rate limiting
- Both TCP and HTTP listeners
- v2 TLV extension support (ALPN, SSL, SNI) is desirable but not required initially
Source IP is lost when Praxis terminates and re-originates TCP connections. In multi-tier proxy deployments (external LB -> Praxis -> backend), the backend sees Praxis's IP instead of the client's.
PROXY protocol is the standard mechanism for source IP preservation in proxy-mode deployments (HAProxy spec, widely adopted by Nginx, Envoy, AWS NLB, etc.).
Goal
Preserve client source IP across proxy tiers using PROXY protocol v1 (text) and v2 (binary).
Requirements