Original Source

The original source listener filter replicates the downstream remote address of the connection on the upstream side of Envoy. For example, if a downstream connection connects to Envoy with IP address , then Envoy will connect to the upstream with source IP 10.1.2.3.

This filter is not supported on Windows.

If the connection has not had its source address translated or proxied, then Envoy can simply use the existing connection information to build the correct downstream remote address. However, if this is not true, a Proxy Protocol filter may be used to extract the downstream remote address.

The downstream remote address used will likely be globally routable. By default, packets returning from the upstream host to that address will not route through Envoy. The network must be configured to forcefully route any traffic whose IP was replicated by Envoy back through the Envoy host.

If Envoy and the upstream are on the same host – e.g. in an sidecar deployment –, then iptables and routing rules can be used to ensure correct behaviour. The filter has an unsigned integer configuration, . Setting this to X causes Envoy to mark all upstream packets originating from this listener with value X. Note that if mark is set to 0, Envoy will not mark upstream packets.

The following example configures Envoy to use the original source for all connections made on port 8888. It uses Proxy Protocol to determine the downstream remote address. All upstream packets are marked with 123.

listeners:
- address:
    socket_address:
      port_value: 8888
    - name: envoy.filters.listener.proxy_protocol
      typed_config:
    - name: envoy.filters.listener.original_src
      typed_config:
        mark: 123