From release 6.1.13, the Connector is able to work with Proxy Protocol v1, available in newer distributions of MySQL from MariaDB and Percona.
By default, when remote clients connect to a Tungsten Cluster via the Connector, the origin IP shown in MySQL maps to the Connector host the client has connected through.
This can have many disadvantages, especially when relying on host level security restricitons within your MySQL database.
The introduction of Proxy Protocol allows the origin IP of the calling client to be passed through instead.
To enable this feature, first you need to ensure you are using a release of MySQL that supports this. At time of documenting this is limited to the following:
Percona-5.6.25-73.0 and greater
MariaDB 10.3 and greater
Currently Proxy Protocol is ONLY available in the releases mentioned above. neither Community edition nor Oracle Enterprise edition yet support this.
Next ensure you enable Proxy Protocol within the
my.cnf by adding the following
* indicates allow all, however this can be a comma-separated list of (sub)networks
or IP addresses instead, to allow finer granularity.
You can now enable the connector to recognise this by enabling the folloing tpm
After applying the property and issuing tpm update (or tools/tpm install if a new installation) you should see the correct origin IP's when querying show processlist and tungsten show processlist
If you enable proxy protocol within the connector, but the underlying database does not support this, you will see the following error:
tpm connectormysql: [Warning] Using a password on the command line interface can be insecure. ERROR 8 (HY000): Could not authorize the user 'app_user' Attempt to connect to the server failed. Could not connect: Got packets out of order Contact your Tungsten administrator.