On Sun, May 05, 2013 at 03:59:48PM +0800, Jianhua Qin wrote: > what about check the conn s_addr and SO_ORIGINAL_DST s_addr like squid?
This is unrelated, I think you misunderstood. I mean, the destination address *is* valid, what is not is the fact that you assigned it to haproxy in the first place. Transparent mode is only meant to be used for intercepted traffic, not for normal proxying. You don't even need an address for doing this. Willy
