coredns/man/coredns-proxyproto.7

.\" Generated by Mmark Markdown Processer - mmark.miek.nl
.TH "COREDNS-PROXYPROTO" 7 "March 2026" "CoreDNS" "CoreDNS Plugins"

.SH "NAME"
.PP
\fIproxyproto\fP - add PROXY protocol
\[la]https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt\[ra] support.

.SH "DESCRIPTION"
.PP
This plugin adds support for the PROXY protocol version 1 and 2. It allows CoreDNS to receive
connections from a load balancer or proxy that uses the PROXY protocol to forward the original
client's IP address and port information.

.SH "SYNTAX"
.PP
.RS

.nf
proxyproto {
    allow <CIDR...>
    default <use|ignore|reject|skip>
}

.fi
.RE

.PP
If \fB\fCallow\fR is unspecified, PROXY protocol headers are accepted from all IP addresses.
The \fB\fCdefault\fR option controls how connections from sources not listed in \fB\fCallow\fR are handled.
If \fB\fCdefault\fR is unspecified, it defaults to \fB\fCignore\fR.
The possible values are:
- \fB\fCuse\fR: accept and use PROXY protocol headers from these sources
- \fB\fCignore\fR: accept and ignore PROXY protocol headers from other sources
- \fB\fCreject\fR: reject connections with PROXY protocol headers from other sources
- \fB\fCskip\fR: skip PROXY protocol processing for connections from other sources, treating them as normal connections preserving the PROXY protocol headers.

.SH "EXAMPLES"
.PP
In this configuration, we allow PROXY protocol connections from all IP addresses:

.PP
.RS

.nf
\&. {
    proxyproto
    forward . /etc/resolv.conf
}

.fi
.RE

.PP
In this configuration, we only allow PROXY protocol connections from the specified CIDR ranges
and ignore proxy protocol headers from other sources:

.PP
.RS

.nf
\&. {
    proxyproto {
        allow 192.168.1.1/32 192.168.0.1/32
    }
    forward . /etc/resolv.conf
}

.fi
.RE

.PP
In this configuration, we only allow PROXY protocol headers from the specified CIDR ranges and reject
connections without valid PROXY protocol headers from those sources:

.PP
.RS

.nf
\&. {
    proxyproto {
        allow 192.168.1.1/32
        default reject
    }
    forward . /etc/resolv.conf
}

.fi
.RE