Does Azure loadbalancer support proxy protocol?

Question

Does Azure Load Balancer support proxy protocol as initiator? If yes, can such communication (traffic flow) be processed (offloaded) by the Load Balancer in/to HW?

Answer 1

@Kratochvil, Michal

Thank you for reaching out on the Microsoft Q&A forum.

Based on your question above.

Does Azure Load Balancer support proxy protocol as initiator?

Azure Load balancer operates on layer 4 and doesn't provide application layer gateway functionality. Protocol handshakes always occur directly between the client and the back-end pool instance.

A response to an inbound flow is always a response from a virtual machine. When the flow arrives on the virtual machine, the original source IP address is also preserved.

You can refer to this article for any additional details.

Now based on your requirements, you can take a look at the Azure Application Gateway which is a web traffic load balancer that enables you to manage traffic to your web applications. Azure Application Gateway appends a x-forwarded-for header which contains the IP:port of the client. You can go through this article for any additional information.

Application Gateway supports four protocols: HTTP, HTTPS, HTTP/2, and WebSocket.

Hope this helps! Please let me know if you have any questions, or if I have misunderstood anything.

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi, my bet here is that Michal was pointing out Proxy Protocol v2, the one defined by Willy Tarreau (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) and with some info prepended to the L4 payload by the LB, it is not something intended to act at L7... https://www.scaleway.com/en/docs/tutorials/proxy-protocol-v2-load-balancer/ https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol Also supported by Google Load Balancer

Answer 3

Az App Gateway supports now TCP/TLS in preview, hence L4. Might help to proxy based on SNI.