# Supporting Original source filter

**URL:** <https://discuss.pomerium.com/t/supporting-original-source-filter/196>\
**Category:** Support\
**Created:** [December 18, 2022, 1:50pm UTC](https://discuss.pomerium.com/t/supporting-original-source-filter/196 "2022-12-18T13:50:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kumarjp](https://avatars.discourse-cdn.com/v4/letter/k/76d3ee/32.png) [@kumarjp](https://discuss.pomerium.com/u/kumarjp)\
**Post date:** [December 18, 2022, 1:50pm UTC](https://discuss.pomerium.com/t/supporting-original-source-filter/196/1 "2022-12-18T13:50:27Z")

</div>

**I’m trying to set the original source filter listener while configuring the Envoy**

## What happened?

I set the _envoy.filters.http.original\_src_ listener filter, with a Mark value while building the Main listener. However, the problem is that Envoy uses the original client IP for the auth requests forwarded to Pomerium as well. This results in the .pomerium/sign\_in response failure from Pomerium.

## What I need support in?

So, is there a way where this listener filter can be set only for the configured routes, and exempt the pomerium routes from this?

## Changes done

1. buildMainListener -

> origSourceCfg := marshalAny(&envoy\_filters\_listener\_orig\_src\_v3.OriginalSrc{  
> Mark: cfg.Options.EnvoyMark,  
> })

> listenerFilters = append(listenerFilters, &envoy\_config\_listener\_v3.ListenerFilter{  
> Name: “envoy.filters.http.original\_src”,  
> ConfigType: &envoy\_config\_listener\_v3.ListenerFilter\_TypedConfig{  
> TypedConfig: origSourceCfg,  
> },  
> })

1. Envoy forwards the auth sign in request to Pomerium over the HTTP\_PORT, with the client-source ip

> 13:47:40.519214 IP .64707 \> 127.0.0.1.26349: Flags [S], seq 4195850707, win 43690, options [mss 65495,sackOK,TS val 2901154527 ecr 0,nop,wscale 11], length 0

1. Results in Error

> “response-code”:503,“response-code-details”:“upstream\_reset\_before\_response\_started{connection\_failure,delayed\_connect\_error:\_110}”,

## What’s your environment like?

- Pomerium version v-0.17

## What’s your config.yaml?

```auto
Not related to config.yaml

```

## What did you see in the logs?

```logs
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"xxxx.xxxx.yyyyyy.com","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","forwarded-for":"101.51.78.32","request-id":"eced7a3d-ddd9-4343-8923-4c379e6af973","duration":9139.790087,"size":145,"response-code":503,"response-code-details":"upstream_reset_before_response_started{connection_failure,delayed_connect_error:_110}","time":"2022-12-17T08:48:57Z","message":"http-request"}

```

---

<div class="post-metadata">

**Author:** ![kumarjp](https://avatars.discourse-cdn.com/v4/letter/k/76d3ee/32.png) [@kumarjp](https://discuss.pomerium.com/u/kumarjp)\
**Post date:** [December 19, 2022, 7:24am UTC](https://discuss.pomerium.com/t/supporting-original-source-filter/196/2 "2022-12-19T07:24:13Z")

</div>

There is a http filter - **envoy.filters.http.original\_src** , which serves the same purpose but per HTTP connection manager… Probably, this is the closest i can get. So, wanted to know if there’s a similar one for Routes. OR to disable it for the pomerium-routes.