1.基于代理(七层负载均衡)情况下 透传客户端的真实IP
环境:
10.0.0.5 proxy_node1 一级代理
10.0.0.6 proxy_node2 二级代理
10.0.0.7 proxy_node3 三级代理
10.0.0.8 webserver 真实节点
域名:ip.cheng.com 解析 --> 10.0.0.5
1.一级代理proxy_node1 Nginx配置如下:
[root@lb01 conf.d]# cat proxy_ip.cheng.com.conf
server {
listen 80;
server_name ip.cheng.com;
location / {
proxy_pass http://10.0.0.6;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
2.二级代理proxy_node2 Nginx配置如下:
[root@lb02 conf.d]# cat proxy_ip.cheng.com.conf
server {
listen 80;
server_name ip.cheng.com;
location / {
proxy_pass http://10.0.0.7;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
3.三级代理proxy_node3 Nginx配置如下:
[root@web01 conf.d]# cat proxy_ip.cheng.com.conf
server {
listen 80;
server_name ip.cheng.com;
location / {
proxy_pass http://10.0.0.8;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
4.WebServer Nginx配置如下:
[root@web02 conf.d]# cat proxy_ip.cheng.com.conf
server {
listen 80;
server_name ip.cheng.com;
root /code;
location / {
index index.php index.html;
}
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
5.测试方式一，通过如下页面获取真实IP，或查看 phpinfo() 函数中的 HTTP_X_FORWARDED_FOR
[root@web02 code]# cat index.php
<?php
$ip = getenv("HTTP_X_FORWARDED_FOR");
echo "X_FORWARDED_FOR: $ip";
?>
6.测试方式二，通过查看日志测试
2.Nginx RealIP获取真实IP
使用nginx Realip_module获取多级代理下的客户端真实IP地址,在真实Web节点上配置，配置信息如下：
[root@web02 conf.d]# cat proxy_ip.cheng.com.conf
server {
listen 80;
server_name ip.cheng.com;
root /code;
set_real_ip_from 10.0.0.5;
set_real_ip_from 10.0.0.6;
set_real_ip_from 10.0.0.7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
location / {
index index.php index.html;
}
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
最终结果是"10.0.0.1 - - "GET /index.php HTTP/1.1" 200 "10.0.0.5, 10.0.0.6"
10.0.0.5，10.0.0.6都出现在set_real_ip_from中，仅仅10.0.0.1没出现，那么他就被认为是用户的ip地址，同时会被赋值到 $remote_addr变量中。
获取真实IP总结：
forwarded-for：可以获取到用户的真实IP地址。
nginx realip：程序无需改动，直接使用remote_addr变量即可获取真实IP地址，但需要知道所有沿途经过的IP地址或IP段
