TCP Connection Proxying with HAProxy: A Beginner’s Guide

Introduction

If you’re a beginner system administrator or developer, you’ve likely faced the task of managing network traffic.
One of the powerful tools for this is HAProxy, a high-performance load balancer for TCP and HTTP.

In this article we’ll cover:

• what TCP proxying is,
• why to use HAProxy,
• a configuration example for beginners,
• tips on security and monitoring.

What is TCP proxying?

TCP proxying is forwarding TCP connections from a client to a server (or a group of servers) through an intermediary.
Unlike an HTTP proxy, which operates at the application layer, TCP proxying happens at the transport layer, making it universal for any TCP protocols: from databases to mail services.

Why use HAProxy?

HAProxy is a lightweight and flexible tool that allows you to:

• 🔄 distribute load across multiple servers;
• ✅ check server availability;
• 📊 provide convenient statistics and monitoring;
• 🔒 handle SSL traffic (termination or end-to-end passthrough).

HAProxy configuration example for TCP proxying

Below is a configuration that listens for connections on port 4444 and forwards them to a test server.

global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    log global
    mode http
    option dontlognull
    timeout connect 5000
    timeout client 50000
    timeout server 50000

frontend tcp-frontend
    bind *:4444
    mode tcp
    default_backend tcp-backend

backend tcp-backend
    mode tcp
    balance roundrobin
    option tcp-check
    server server1 192.168.1.100:443 weight 1 check

Configuration breakdown

• global — sets basic parameters (logging, chroot, user, daemon mode).
• defaults — default options, including timeouts. By default mode http, but in frontend and backend we override it to tcp.
• frontend tcp-frontend — listens on port 4444 and forwards requests to the backend.
• backend tcp-backend — balances connections and defines the list of servers. Availability checks are enabled by the check parameter in the server line: without it HAProxy does not check the server, even if option tcp-check is specified in the backend. The option tcp-check directive only specifies how to check — by default this is an attempt to open a TCP connection.

Setting up HAProxy step by step

1. Install HAProxy:

   bash Copy

   # Ubuntu/Debian
   sudo apt update && sudo apt install haproxy
   
   # CentOS/RHEL
   sudo yum install haproxy

2. Save the configuration to /etc/haproxy/haproxy.cfg.

3. Check the syntax:

   bash Copy

   haproxy -c -f /etc/haproxy/haproxy.cfg

4. Restart the service:

   bash Copy

   sudo systemctl restart haproxy
   sudo systemctl enable haproxy

5. Test the connection:

   bash Copy

   telnet <haproxy-ip> 4444

Monitoring: the statistics page

To monitor the state of servers and connections, add the section:

frontend stats
    bind 127.0.0.1:8404
    mode http
    stats enable
    stats uri /stats
    stats refresh 10s
    stats auth admin:replace-with-a-long-password

The page listens only on the local address, so it’s not accessible from the Internet. You can open it via an SSH tunnel:

ssh -L 8404:127.0.0.1:8404 user@<haproxy-ip>

and then in your browser go to http://127.0.0.1:8404/stats.

Do not publish the statistics page on an external address, and enable the stats admin directive (server management from the web interface) only together with authentication and access restriction: with it you can take servers out of service via the page.

Tips for beginners

• 🔐 Security — keep the statistics page on 127.0.0.1 or behind a VPN and use a long password.

• 🩺 Server health — don’t forget check on every server line. Basic TCP checks can be extended with protocol-specific checks (for example, option mysql-check, option pgsql-check, option smtpchk).

• ⚡ Scaling — add more servers:

  cfg Copy

  server server2 192.168.1.101:443 weight 1 check
  server server3 192.168.1.102:443 weight 1 check

• 📝 Logging — check /var/log/haproxy.log (configure rsyslog if necessary).

Use cases

• Load balancing databases (MySQL, PostgreSQL).
• Proxying mail services (SMTP, IMAP).
• End-to-end SSL proxying.
• A single entry point for microservices.

Conclusion

HAProxy makes TCP proxying simple even for beginners. Just configure a frontend and backend, add availability checks and monitoring — and you have a reliable proxy.

As you gain experience you can move to advanced scenarios: SSL termination, ACLs, protocol-specific checks. A detailed breakdown of HAProxy in HTTP mode, stick-tables and the statistics page is in the article “Proxy Servers: Part 3 — HAProxy”.

Good luck with your configuration and load balancing! 🚀