13.多级代理下Nginx透传真实IP

- 日理万妓 2023-08-17 15:37 103阅读 0赞

## 1.基于代理(七层负载均衡)情况下 透传客户端的真实IP ##

#### 环境: ####

> 10.0.0.5 proxy\_node1 一级代理  
> 10.0.0.6 proxy\_node2 二级代理  
> 10.0.0.7 proxy\_node3 三级代理  
> 10.0.0.8 webserver 真实节点  
> 域名:ip.cheng.com 解析 --> 10.0.0.5

***1.一级代理proxy\_node1 Nginx配置如下:***

[root@lb01 conf.d]# cat proxy_ip.cheng.com.conf 
    server {
        listen 80;
        server_name ip.cheng.com;
    
        location / {
        proxy_pass http://10.0.0.6;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    
        }
    }

***2.二级代理proxy\_node2 Nginx配置如下:***

[root@lb02 conf.d]# cat proxy_ip.cheng.com.conf 
    server {
        listen 80;
        server_name ip.cheng.com;
    
        location / {
        proxy_pass http://10.0.0.7;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    
        }
    }

***3.三级代理proxy\_node3 Nginx配置如下:***

[root@web01 conf.d]# cat proxy_ip.cheng.com.conf 
    server {
        listen 80;
        server_name ip.cheng.com;
    
        location / {
        proxy_pass http://10.0.0.8;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    
        }
    }

***4.WebServer Nginx配置如下:***

[root@web02 conf.d]# cat proxy_ip.cheng.com.conf 
    server {
        listen 80;
        server_name ip.cheng.com;
        root /code;
    
        location / {
        index index.php index.html;
        }
    
        location ~ \.php$ {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        }
    }

5.**测试方式一**，通过如下页面获取真实IP，或查看 phpinfo() 函数中的 HTTP\_X\_FORWARDED\_FOR

[root@web02 code]# cat index.php 
    <?php
        $ip = getenv("HTTP_X_FORWARDED_FOR");
        echo "X_FORWARDED_FOR: $ip";
    ?>

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70]  
***6.测试方式二，通过查看日志测试***  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 2]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 3]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 4]

## 2.Nginx RealIP获取真实IP ##

***使用nginx Realip\_module获取多级代理下的客户端真实IP地址,在真实Web节点上配置，配置信息如下：***

[root@web02 conf.d]# cat proxy_ip.cheng.com.conf 
    server {
        listen 80;
        server_name ip.cheng.com;
        root /code;
        set_real_ip_from 10.0.0.5;
        set_real_ip_from 10.0.0.6;
        set_real_ip_from 10.0.0.7;
        real_ip_header   X-Forwarded-For;
        real_ip_recursive on;
    
        location / {
        index index.php index.html;
        }
    
        location ~ \.php$ {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        }
    }
    
    最终结果是"10.0.0.1 - - "GET /index.php HTTP/1.1" 200 "10.0.0.5, 10.0.0.6"
    10.0.0.5，10.0.0.6都出现在set_real_ip_from中，仅仅10.0.0.1没出现，那么他就被认为是用户的ip地址，同时会被赋值到 $remote_addr变量中。
    
    获取真实IP总结：
    forwarded-for：可以获取到用户的真实IP地址。
    nginx realip：程序无需改动，直接使用remote_addr变量即可获取真实IP地址，但需要知道所有沿途经过的IP地址或IP段

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 5]

转载于:https://www.cnblogs.com/yinwu/p/11569452.html

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70]: /images/20230810/d1feadcdb7d44334912019f1436a8b85.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 1]: /images/20230810/684aae22f08f40d5b9942988b7f33528.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 2]: /images/20230810/d4a2d26c6c6042f39a190145602f5a7b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 3]: /images/20230810/ff43fef85b924ed99a601a9543f0ae37.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 4]: /images/20230810/425adc25c1d94c0eb4f6c1a9acf6ea27.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5neWlud3U_size_16_color_FFFFFF_t_70 5]: /images/20230810/576d7fa3551c425ca72d2f7fc7dfadc0.png