INTERNAL I did get there in the end. I added a bind statement and then had to reduce the network from /22 to each of the proxy servers and success.
However for proxy_protocol_network, x.x.x.x/22 is NOT the same as * so this should have worked. But thanks for the assist anyway. From: Илья Шипицин <[email protected]> Sent: Wednesday, June 24, 2026 9:41 PM To: Marc Hoppins <[email protected]> Cc: [email protected] Subject: Re: [EXT]Re: HAProxy and Percona [External Sender] I was following that guide: Planet MySQL :: Planet MySQL - Archives - Proxy Protocol and Percona XtraDB Cluster: A Quick...<https://planet.mysql.com/entry/?id=5992587> (link to bugs at the bottom) ср, 24 июн. 2026 г. в 21:31, Илья Шипицин <[email protected]<mailto:[email protected]>>: I was able to connect via haproxy(with proxy protocol) to percona server. it seems that the following bug is still not fixed Bug #1502408 “When using proxy protocol, mysql needs to bind to ...” : Bugs : Percona Server moved to https://jira.percona.com/projects/PS<https://bugs.launchpad.net/percona-server/+bug/1502408> so, after I added "bind-address = 192.168.122.16" - it did work also, I used "send-proxy", not "send-proxy-v2" I wonder what Percona support says on that :) ср, 24 июн. 2026 г. в 10:18, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL For information: I run the same query 4x and changed tcpdump logging levels (basic, -v, -vv, -vvv). tcpdump -v, -vv, and -vvv made no difference in this case. So there is a basic dump and a verbose dump. tcpdump 'tcp and port 3306' listening on ens192, link-type EN10MB (Ethernet), snapshot length 262144 bytes 10:01:47.596092 IP CLIENT.54760 > PROXY.mysql: Flags [S], seq 3405779001, win 64240, options [mss 1460,sackOK,TS val 2060637408 ecr 0,nop,wscale 7], length 0 10:01:47.596133 IP PROXY.mysql > CLIENT.54760: Flags [S.], seq 1346294803, ack 3405779002, win 65160, options [mss 1460,sackOK,TS val 1452809140 ecr 2060637408,nop,wscale 7], length 0 10:01:47.596222 IP CLIENT.54760 > PROXY.mysql: Flags [.], ack 1, win 502, options [nop,nop,TS val 2060637408 ecr 1452809140], length 0 10:01:47.596395 IP PROXY.47996 > PERCONA.mysql: Flags [S], seq 2657131732, win 64240, options [mss 1460,sackOK,TS val 1038192193 ecr 0,nop,wscale 7], length 0 10:01:47.596538 IP PERCONA.mysql > PROXY.47996: Flags [S.], seq 2362279714, ack 2657131733, win 65160, options [mss 1460,sackOK,TS val 1688432743 ecr 1038192193,nop,wscale 7], length 0 10:01:47.596551 IP PROXY.47996 > PERCONA.mysql: Flags [.], ack 1, win 502, options [nop,nop,TS val 1038192194 ecr 1688432743], length 0 10:01:47.596578 IP PROXY.47996 > PERCONA.mysql: Flags [P.], seq 1:50, ack 1, win 502, options [nop,nop,TS val 1038192194 ecr 1688432743], length 49 10:01:47.596637 IP PERCONA.mysql > PROXY.47996: Flags [.], ack 50, win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 0 10:01:47.596849 IP PERCONA.mysql > PROXY.47996: Flags [P.], seq 1:82, ack 50, win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 81 10:01:47.596855 IP PROXY.47996 > PERCONA.mysql: Flags [.], ack 82, win 502, options [nop,nop,TS val 1038192194 ecr 1688432743], length 0 10:01:47.596878 IP PERCONA.mysql > PROXY.47996: Flags [P.], seq 82:119, ack 50, win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 37 10:01:47.596881 IP PROXY.47996 > PERCONA.mysql: Flags [.], ack 119, win 502, options [nop,nop,TS val 1038192194 ecr 1688432743], length 0 10:01:47.596888 IP PERCONA.mysql > PROXY.47996: Flags [F.], seq 119, ack 50, win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 0 10:01:47.596891 IP PERCONA.mysql > PROXY.47996: Flags [R.], seq 120, ack 50, win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 0 10:01:47.596902 IP PROXY.mysql > CLIENT.54760: Flags [P.], seq 1:82, ack 1, win 510, options [nop,nop,TS val 1452809141 ecr 2060637408], length 81 10:01:47.596914 IP PERCONA.mysql > PROXY.47996: Flags [R], seq 2362279796, win 0, length 0 10:01:47.596928 IP PROXY.mysql > CLIENT.54760: Flags [F.], seq 82:119, ack 1, win 510, options [nop,nop,TS val 1452809141 ecr 2060637408], length 37 10:01:47.596944 IP CLIENT.54760 > PROXY.mysql: Flags [.], ack 82, win 502, options [nop,nop,TS val 2060637409 ecr 1452809141], length 0 10:01:47.596966 IP PERCONA.mysql > PROXY.47996: Flags [R], seq 2362279833, win 0, length 0 10:01:47.596968 IP CLIENT.54760 > PROXY.mysql: Flags [P.], seq 1:37, ack 120, win 502, options [nop,nop,TS val 2060637409 ecr 1452809141], length 36 10:01:47.596973 IP PROXY.mysql > CLIENT.54760: Flags [.], ack 37, win 510, options [nop,nop,TS val 1452809141 ecr 2060637409], length 0 10:01:47.616816 IP CLIENT.54760 > PROXY.mysql: Flags [P.], seq 37:359, ack 120, win 502, options [nop,nop,TS val 2060637429 ecr 1452809141], length 322 10:01:47.616837 IP PROXY.mysql > CLIENT.54760: Flags [R], seq 1346294923, win 0, length 0 10:01:47.616851 IP CLIENT.54760 > PROXY.mysql: Flags [F.], seq 359, ack 120, win 502, options [nop,nop,TS val 2060637429 ecr 1452809141], length 0 10:01:47.616858 IP PROXY.mysql > CLIENT.54760: Flags [R], seq 1346294923, win 0, length 0 10:01:47.616864 IP CLIENT.54760 > PROXY.mysql: Flags [R.], seq 360, ack 120, win 502, options [nop,nop,TS val 2060637429 ecr 1452809141], length 0 ^C 26 packets captured 26 packets received by filter 0 packets dropped by kernel tcpdump: listening on ens192, link-type EN10MB (Ethernet), snapshot length 262144 bytes 10:10:53.149329 IP (tos 0x0, ttl 64, id 7123, offset 0, flags [DF], proto TCP (6), length 60) CLIENT.45588 > PROXY.mysql: Flags [S], cksum 0x9372 (correct), seq 3076748161, win 64240, options [mss 1460,sackOK,TS val 2061182961 ecr 0,nop,wscale 7], length 0 10:10:53.149363 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) PROXY.mysql > CLIENT.45588: Flags [S.], cksum 0x2d1b (incorrect -> 0xdbef), seq 2036954378, ack 3076748162, win 65160, options [mss 1460,sackOK,TS val 1453354693 ecr 2061182961,nop,wscale 7], length 0 10:10:53.149438 IP (tos 0x0, ttl 64, id 7124, offset 0, flags [DF], proto TCP (6), length 52) CLIENT.45588 > PROXY.mysql: Flags [.], cksum 0x074f (correct), seq 1, ack 1, win 502, options [nop,nop,TS val 2061182961 ecr 1453354693], length 0 10:10:53.149613 IP (tos 0x0, ttl 64, id 37818, offset 0, flags [DF], proto TCP (6), length 60) PROXY.34772 > PERCONA.mysql: Flags [S], cksum 0x2d3e (incorrect -> 0x996a), seq 3232371183, win 64240, options [mss 1460,sackOK,TS val 1038737747 ecr 0,nop,wscale 7], length 0 10:10:53.149752 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) PERCONA.mysql > PROXY.34772: Flags [S.], cksum 0x42a5 (correct), seq 2602143710, ack 3232371184, win 65160, options [mss 1460,sackOK,TS val 1688978296 ecr 1038737747,nop,wscale 7], length 0 10:10:53.149764 IP (tos 0x0, ttl 64, id 37819, offset 0, flags [DF], proto TCP (6), length 52) PROXY.34772 > PERCONA.mysql: Flags [.], cksum 0x2d36 (incorrect -> 0x6e04), seq 1, ack 1, win 502, options [nop,nop,TS val 1038737747 ecr 1688978296], length 0 10:10:53.149776 IP (tos 0x0, ttl 64, id 37820, offset 0, flags [DF], proto TCP (6), length 101) PROXY.34772 > PERCONA.mysql: Flags [P.], cksum 0x2d67 (incorrect -> 0x38f9), seq 1:50, ack 1, win 502, options [nop,nop,TS val 1038737747 ecr 1688978296], length 49 10:10:53.149847 IP (tos 0x0, ttl 64, id 28480, offset 0, flags [DF], proto TCP (6), length 52) PERCONA.mysql > PROXY.34772: Flags [.], cksum 0x6dcc (correct), seq 1, ack 50, win 509, options [nop,nop,TS val 1688978296 ecr 1038737747], length 0 10:10:53.150071 IP (tos 0x0, ttl 64, id 28481, offset 0, flags [DF], proto TCP (6), length 133) PERCONA.mysql > PROXY.34772: Flags [P.], cksum 0x8bff (correct), seq 1:82, ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747], length 81 10:10:53.150078 IP (tos 0x0, ttl 64, id 37821, offset 0, flags [DF], proto TCP (6), length 52) PROXY.34772 > PERCONA.mysql: Flags [.], cksum 0x2d36 (incorrect -> 0x6d81), seq 50, ack 82, win 502, options [nop,nop,TS val 1038737747 ecr 1688978297], length 0 10:10:53.150088 IP (tos 0x0, ttl 64, id 3732, offset 0, flags [DF], proto TCP (6), length 133) PROXY.mysql > CLIENT.45588: Flags [P.], cksum 0x2d64 (incorrect -> 0x257a), seq 1:82, ack 1, win 510, options [nop,nop,TS val 1453354694 ecr 2061182961], length 81 10:10:53.150118 IP (tos 0x0, ttl 64, id 28482, offset 0, flags [DF], proto TCP (6), length 89) PERCONA.mysql > PROXY.34772: Flags [P.], cksum 0x6088 (correct), seq 82:119, ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747], length 37 10:10:53.150124 IP (tos 0x0, ttl 64, id 37822, offset 0, flags [DF], proto TCP (6), length 52) PROXY.34772 > PERCONA.mysql: Flags [.], cksum 0x2d36 (incorrect -> 0x6d5c), seq 50, ack 119, win 502, options [nop,nop,TS val 1038737747 ecr 1688978297], length 0 10:10:53.150128 IP (tos 0x0, ttl 64, id 7125, offset 0, flags [DF], proto TCP (6), length 52) CLIENT.45588 > PROXY.mysql: Flags [.], cksum 0x06fc (correct), seq 1, ack 82, win 502, options [nop,nop,TS val 2061182962 ecr 1453354694], length 0 10:10:53.150131 IP (tos 0x0, ttl 64, id 3733, offset 0, flags [DF], proto TCP (6), length 89) PROXY.mysql > CLIENT.45588: Flags [P.], cksum 0x2d38 (incorrect -> 0xfa02), seq 82:119, ack 1, win 510, options [nop,nop,TS val 1453354694 ecr 2061182961], length 37 10:10:53.150132 IP (tos 0x0, ttl 64, id 28483, offset 0, flags [DF], proto TCP (6), length 52) PERCONA.mysql > PROXY.34772: Flags [F.], cksum 0x6d54 (correct), seq 119, ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747], length 0 10:10:53.150138 IP (tos 0x0, ttl 64, id 7126, offset 0, flags [DF], proto TCP (6), length 88) CLIENT.45588 > PROXY.mysql: Flags [P.], cksum 0xa308 (correct), seq 1:37, ack 82, win 502, options [nop,nop,TS val 2061182962 ecr 1453354694], length 36 10:10:53.150142 IP (tos 0x0, ttl 64, id 3734, offset 0, flags [DF], proto TCP (6), length 52) PROXY.mysql > CLIENT.45588: Flags [.], cksum 0x2d13 (incorrect -> 0x06ab), seq 119, ack 37, win 510, options [nop,nop,TS val 1453354694 ecr 2061182962], length 0 10:10:53.150151 IP (tos 0x0, ttl 64, id 28484, offset 0, flags [DF], proto TCP (6), length 52) PERCONA.mysql > PROXY.34772: Flags [R.], cksum 0x6d50 (correct), seq 120, ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747], length 0 10:10:53.150154 IP (tos 0x0, ttl 64, id 3735, offset 0, flags [DF], proto TCP (6), length 52) PROXY.mysql > CLIENT.45588: Flags [F.], cksum 0x2d13 (incorrect -> 0x06aa), seq 119, ack 37, win 510, options [nop,nop,TS val 1453354694 ecr 2061182962], length 0 10:10:53.150187 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) PERCONA.mysql > PROXY.34772: Flags [R], cksum 0xc2c8 (correct), seq 2602143792, win 0, length 0 10:10:53.150196 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) PERCONA.mysql > PROXY.34772: Flags [R], cksum 0xc2a3 (correct), seq 2602143829, win 0, length 0 10:10:53.153428 IP (tos 0x0, ttl 64, id 3736, offset 0, flags [DF], proto TCP (6), length 52) PROXY.mysql > CLIENT.45588: Flags [F.], cksum 0x2d13 (incorrect -> 0x06a6), seq 119, ack 37, win 510, options [nop,nop,TS val 1453354698 ecr 2061182962], length 0 10:10:53.153460 IP (tos 0x0, ttl 64, id 7127, offset 0, flags [DF], proto TCP (6), length 64) CLIENT.45588 > PROXY.mysql: Flags [.], cksum 0xf2c0 (correct), seq 37, ack 120, win 502, options [nop,nop,TS val 2061182965 ecr 1453354694,nop,nop,sack 1 {119:120}], length 0 10:10:53.169752 IP (tos 0x0, ttl 64, id 7128, offset 0, flags [DF], proto TCP (6), length 374) CLIENT.45588 > PROXY.mysql: Flags [P.], cksum 0xbe20 (correct), seq 37:359, ack 120, win 502, options [nop,nop,TS val 2061182982 ecr 1453354694], length 322 10:10:53.169758 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) PROXY.mysql > CLIENT.45588: Flags [R], cksum 0xd509 (correct), seq 2036954498, win 0, length 0 10:10:53.169767 IP (tos 0x0, ttl 64, id 7129, offset 0, flags [DF], proto TCP (6), length 52) CLIENT.45588 > PROXY.mysql: Flags [F.], cksum 0x055b (correct), seq 359, ack 120, win 502, options [nop,nop,TS val 2061182982 ecr 1453354694], length 0 10:10:53.169772 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) PROXY.mysql > CLIENT.45588: Flags [R], cksum 0xd509 (correct), seq 2036954498, win 0, length 0 10:10:53.169777 IP (tos 0x0, ttl 64, id 7130, offset 0, flags [DF], proto TCP (6), length 52) CLIENT.45588 > PROXY.mysql: Flags [R.], cksum 0x0557 (correct), seq 360, ack 120, win 502, options [nop,nop,TS val 2061182982 ecr 1453354694], length 0 ^C 29 packets captured 29 packets received by filter 0 packets dropped by kernel From: Илья Шипицин <[email protected]<mailto:[email protected]>> Sent: Wednesday, June 24, 2026 9:25 AM To: Marc Hoppins <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: Re: [EXT]Re: HAProxy and Percona [External Sender] I had Fedora linux available, but no package of Percona server. once I'll install Ubuntu, I'll give it a try ср, 24 июн. 2026 г. в 08:44, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL I managed to get this out of the general_log. I am unable to determine if the proxy sent incorrect session information or the percona just refuses to accept it. 15:21:20.281473 IP CLIENT.55386 > PROXY.mysql: Flags [S], seq 961108031, win 64240, options [mss 1460,sackOK,TS val 1993410093 ecr 0,nop,wscale 7], length 0 15:21:20.281506 IP PROXY.mysql > CLIENT.55386: Flags [S.], seq 3122485353, ack 961108032, win 65160, options [mss 1460,sackOK,TS val 1385581826 ecr 1993410093,nop,wscale 7], length 0 15:21:20.281575 IP CLIENT.55386 > PROXY.mysql: Flags [.], ack 1, win 502, options [nop,nop,TS val 1993410093 ecr 1385581826], length 0 15:21:20.281695 IP PROXY.32826 > PERCONA.mysql: Flags [S], seq 1728864001, win 64240, options [mss 1460,sackOK,TS val 970964879 ecr 0,nop,wscale 7], length 0 15:21:20.281853 IP PERCONA.mysql > PROXY.32826: Flags [S.], seq 2520953573, ack 1728864002, win 65160, options [mss 1460,sackOK,TS val 1621205428 ecr 970964879,nop,wscale 7], length 0 15:21:20.281865 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 1, win 502, options [nop,nop,TS val 970964879 ecr 1621205428], length 0 15:21:20.281884 IP PROXY.32826 > PERCONA.mysql: Flags [P.], seq 1:50, ack 1, win 502, options [nop,nop,TS val 970964879 ecr 1621205428], length 49 15:21:20.281968 IP PERCONA.mysql > PROXY.32826: Flags [.], ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0 15:21:20.282196 IP PERCONA.mysql > PROXY.32826: Flags [P.], seq 1:82, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 81 15:21:20.282200 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 82, win 502, options [nop,nop,TS val 970964879 ecr 1621205429], length 0 15:21:20.282214 IP PROXY.mysql > CLIENT.55386: Flags [P.], seq 1:82, ack 1, win 510, options [nop,nop,TS val 1385581826 ecr 1993410093], length 81 15:21:20.282222 IP PERCONA.mysql > PROXY.32826: Flags [P.], seq 82:119, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 37 15:21:20.282225 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 119, win 502, options [nop,nop,TS val 970964879 ecr 1621205429], length 0 15:21:20.282230 IP PERCONA.mysql > PROXY.32826: Flags [F.], seq 119, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0 15:21:20.282232 IP PERCONA.mysql > PROXY.32826: Flags [R.], seq 120, ack 50, win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0 15:21:20.282246 IP PROXY.mysql > CLIENT.55386: Flags [F.], seq 82:119, ack 1, win 510, options [nop,nop,TS val 1385581826 ecr 1993410093], length 37 15:21:20.282254 IP CLIENT.55386 > PROXY.mysql: Flags [.], ack 82, win 502, options [nop,nop,TS val 1993410094 ecr 1385581826], length 0 15:21:20.282261 IP PERCONA.mysql > PROXY.32826: Flags [R], seq 2520953655, win 0, length 0 15:21:20.282273 IP PERCONA.mysql > PROXY.32826: Flags [R], seq 2520953692, win 0, length 0 15:21:20.282277 IP CLIENT.55386 > PROXY.mysql: Flags [P.], seq 1:37, ack 82, win 502, options [nop,nop,TS val 1993410094 ecr 1385581826], length 36 15:21:20.282285 IP PROXY.mysql > CLIENT.55386: Flags [.], ack 37, win 510, options [nop,nop,TS val 1385581826 ecr 1993410094], length 0 15:21:20.301595 IP CLIENT.55386 > PROXY.mysql: Flags [P.], seq 37:359, ack 120, win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 322 15:21:20.301605 IP PROXY.mysql > CLIENT.55386: Flags [R], seq 3122485473, win 0, length 0 15:21:20.301614 IP CLIENT.55386 > PROXY.mysql: Flags [F.], seq 359, ack 120, win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 0 15:21:20.301619 IP PROXY.mysql > CLIENT.55386: Flags [R], seq 3122485473, win 0, length 0 15:21:20.301623 IP CLIENT.55386 > PROXY.mysql: Flags [R.], seq 360, ack 120, win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 0 From: Илья Шипицин <[email protected]<mailto:[email protected]>> Sent: Thursday, June 18, 2026 4:00 PM To: Marc Hoppins <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: [EXT]Re: HAProxy and Percona [External Sender] as a naive guess, maybe adding " mode tcp" to frontend will help (you have that in "default" and likely it should be inherited, but I specify explicitly) ср, 17 июн. 2026 г. в 14:08, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL Hi, I am trying to get source IP recognition sorted to a percona cluster. Following a directive to configure the proxy/percona setup to correctly identify client operations by source address, I reconfigured percona backends with send-proxy. I now have: source-host - proxy-node - percona node (8.4.7) I installed mysql. If I connect to source to proxy-node:3306 I get:- ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL routines::wrong version number I did try (from source) openssl s_client and gave path to the directory where our certificates are. It is the same path on all installed hosts companywide and contains the same base certificates, including our own self-signed one(s). I do see verify error:num=19:self-signed certificate in certificate chain from the output but I am reluctant to admit this is the cause. I did try removing (commenting out) the ssl bind options fro HAproxy config and restarting but the same error (ERROR 2026) appears. I can find no 8.4.7 client from percona. HAPROXY for the front/back defaults pxc_d2 log global mode tcp option tcplog option dontlognull retries 3 timeout connect 10s timeout client 1h timeout server 1h frontend pxc-d2-frontend from pxc_d2 bind *:3306 use_backend pxc-d2-backend backend pxc-d2-backend from pxc_d2 default-server inter 1001 rise 3 fall 3 on-marked-down shutdown-sessions default-server port 9200 check send-proxy balance roundrobin server d2-db-node01 xx.xx.140.45:3306 server d2-db-node02 xx.xx.140.46:3306 backup server d2-db-node03 xx.xx.140.47:3306 backup Where would I see any access attempts from client to target? The haproxy.log shows nothing, only regular Zabbix connections. Initially I contacted percona thinking that it was a problem with TLS/SSL and their interactions may be seen here https://forums.percona.com/t/connecting-to-database-through-haproxy/40920 Any ideas would be helpful. Marc
