Q: Q: When should you use HAProxy SSL termination versus TCP passthrough, and how do you preserve original client IP addresses?
Essential HAProxy interview questions: compare SSL termination vs TCP passthrough, PROXY protocol v2, X-Forwarded-For headers, and backend TLS offloading.
Want to master this scenario in a live sandbox? KodeKloud's Istio Service Mesh & Advanced Kubernetes Networking Course covers this exact problem with hands-on terminal drills.
🛠️ Production Runbook & Step-by-Step Resolution
Direct Answer: When interviewers explore haproxy interview questions about TLS edge architecture, I delineate the trade-offs between SSL termination and TCP passthrough. SSL termination offloads cryptographic compute and allows Layer 7 inspection, cookie sticky sessions, and header mutation. TCP passthrough delivers end-to-end encryption for strict zero-trust compliance. I explain how to preserve client source IPs in both modes using X-Forwarded-For and PROXY Protocol v2.
Architectural Trade-Off: Layer 7 SSL Termination vs Layer 4 TCP Passthrough
SSL termination decrypts TLS certificates at the HAProxy edge. This empowers HAProxy to inspect HTTP headers, enforce rate limits, apply path-based routing rules, and compress payloads before proxying plaintext or re-encrypted HTTP to backend servers. TCP passthrough operates strictly at OSI Layer 4: HAProxy routes raw encrypted TLS bytes directly to backend origins using Server Name Indication (SNI) inspection, never holding decryption keys.
# Layer 7 Termination allows inspecting HTTP paths, headers, and cookies
# Layer 4 Passthrough routes raw TCP packets based on TLS SNI without decryptingImplement HAProxy Layer 7 SSL Termination with Modern TLS Ciphers & ALPN
I configure HAProxy to bind port 443 with modern TLS 1.3/1.2 ciphers, ALPN negotiation for HTTP/2 support, and automatic X-Forwarded-For header insertion. This offloads cryptographic burden from application microservices while maintaining full HTTP observability.
frontend fe_https
bind :443 ssl crt /etc/ssl/certs/app.pem alpn h2,http/1.1
mode http
# Preserve client IP and protocol headers for upstream servers
option forwardfor
http-request set-header X-Forwarded-Proto https
http-request set-header X-Forwarded-Port %[dst_port]
default_backend be_api_servers
backend be_api_servers
mode http
balance roundrobin
cookie SERVERID insert indirect nocache
server api01 10.0.2.11:8080 check cookie api01
server api02 10.0.2.12:8080 check cookie api02Implement HAProxy Layer 4 TCP Passthrough with SNI Routing & PROXY Protocol v2
When compliance requires end-to-end zero-trust encryption, HAProxy inspects the TLS ClientHello SNI header without terminating the session. Because Layer 4 proxying hides client source IPs behind the proxy IP, we enable PROXY protocol v2 (send-proxy-v2) so downstream backends receive the genuine client IP inside a binary header before the TLS handshake.
frontend fe_tcp_tls_passthrough
bind :443
mode tcp
option tcplog
# Inspect ClientHello SNI without terminating TLS
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
# SNI based routing to distinct backends
use_backend be_payment_tls if { req_ssl_sni -m end payment.internal.com }
default_backend be_default_tls
backend be_payment_tls
mode tcp
balance roundrobin
# send-proxy-v2 prepends PROXY protocol header containing client real IP
server secure_node01 10.0.5.21:8443 check send-proxy-v2
server secure_node02 10.0.5.22:8443 check send-proxy-v2Configure Upstream Ingress to Parse PROXY Protocol Headers
If the backend application or ingress controller (such as Nginx or Traefik) does not know PROXY protocol is enabled, it interprets the binary prefix as corrupt HTTP and drops the connection. I show how upstream web servers must be explicitly configured to accept the PROXY protocol.
# Upstream Nginx backend configuration accepting PROXY protocol:
# server {
# listen 8443 ssl proxy_protocol;
# set_real_ip_from 10.0.1.0/24; # Trust HAProxy subnet
# real_ip_header proxy_protocol;
# }- Use SSL termination when you need Layer 7 routing, cookie stickiness, WAF security inspection, or centralized TLS certificate maintenance.
- Choose TCP passthrough when regulatory compliance mandates zero-trust end-to-end encryption where intermediate balancers must never access decrypted application payloads.
- In SSL termination mode, client IP preservation is achieved via option forwardfor injecting X-Forwarded-For headers.
- In TCP passthrough mode, use send-proxy-v2 in HAProxy to prepend client source metadata at Layer 4, ensuring upstream origins log genuine client IPs.
Senior hiring managers and bar raisers evaluate how you prioritize during outages. Avoid these common anti-patterns:
- Enabling send-proxy-v2 on HAProxy without configuring the backend to accept it The backend web server will treat the PROXY protocol binary header as malformed HTTP/TLS data and immediately return connection resets or HTTP 400 Bad Request.
- Attempting HTTP header modification in mode tcp In Layer 4 mode, HAProxy handles raw TCP byte streams; http-request header rules will be silently ignored or cause configuration parse errors.
- Omitting tcp-request inspect-delay during SNI extraction Without an inspection buffer window, HAProxy evaluates the SNI rule before the client sends the initial TLS ClientHello packet, defaulting to the fallback backend.