Linux-多级代理实现客户端IP透传

设备：

客户端clent                    centos7     10.0.0.47

代理服务器proxy1          centos7    10.0.0.57          编译安装的nginx

代理服务器proxy2          centos8    10.0.0.8            yum安装的nginx

后端httpd服务器httpd     centos8    10.0.0.88          yum安装的httpd

 

1、设置proxy1 代理服务器 10.0.0.57

[root@proxy1 ~]#vim  /usr/local/nginx/conf/conf.d/pc.conf          #一级代理，可以在设置子配置文件设置以下配置
server {
  listen 80;
  server_name www.lyj.org;
  root /data/nginx/html/pc;
  proxy_set_header x-Forwarded-For $proxy_add_x_forwarded_for;     #更改或添加客户端的请求头部信息内容并转发至后端服务器
　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　  #此变量表示将客户端IP追加请求报文中X-Forwarded-For首部字段， 在日志中显示
  location / {
    proxy_pass http://10.0.0.8;                                    ##用来设置将客户端请求转发给的后端服务器的主机
   }
}

加载配置文件

[root@proxy1 ~]#nginx -s reload

2、配置proxy2 代理服务器 10.0.0.8

二级代理的配置信息需要写进主配置文件。

（写在子配置文件中，触发不了文件调用  include /etc/nginx/conf.d/*.conf;）

 

 

 注释或删除原来的server 配置信息

[root@proxy2 ~]#vim /etc/nginx/nginx.conf
#    server {
#        listen       80 default_server;
#        listen       [::]:80 default_server;
#        server_name  _;
#        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.

#        location / {
#        }

#        error_page 404 /404.html;
#            location = /40x.html {
#        }

注释掉原有的server 的配置信息

写入代理配置

[root@proxy2 ~]#vim /etc/nginx/nginx.conf
 server {
    listen 80;
    server_name www.lyj.org;
    root /data/nginx/html/pc;
    proxy_set_header x-Forwarded-For $proxy_add_x_forwarded_for;
      location / {
      proxy_pass http://10.0.0.8;
      }
    }

 

后端httpd  web服务器   10.0.0.88

修改配置文件，设置日志访问记录IP透传

[root@httpd ~]#vim /etc/httpd/conf/httpd.conf

<IfModule log_config_module>
    #
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below).
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{x-Forwarded-For}i\"" combined     #添加\"%{x-Forwarded-For}i\" 代理服务器中设置好的ip透传设置
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
      # You need to enable mod_logio.c to use %I and %O
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

设置测试页面

[root@httpd ~]#cat /var/www/html/index.html 
10.0.0.88 hostname-webserver

 

测试

为了更好的观察 代理服务器日志也开启IP透传的信息

proxy1 代理日志开启  10.0.0.57     编译安装的nginx

[root@proxy1 ~]#vim /usr/local/nginx/conf/nginx.conf

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '         #取消注释#符号，启动
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

proxy2 代理日志开启     10.0.0.8    yum安装的nginx

[root@proxy2 ~]#vim /etc/nginx/nginx.conf

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '    #取消注释#符号，启动
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

重新加载配置文件

nginx -s reload

客户端测试，查看日志状态

[root@client ~]#curl  www.lyj.org            #客户端访问正常，获取后端httpd服务的web界面
10.0.0.88 hostname-webserver
[root@client ~]#curl www.lyj.org
10.0.0.88 hostname-webserver
[root@client ~]#curl www.lyj.org
10.0.0.88 hostname-webserver
[root@client ~]#curl www.lyj.org
10.0.0.88 hostname-webserver
[root@client ~]#curl www.lyj.org
10.0.0.88 hostname-webserver

日志记录

proxy1

[root@proxy1 ~]#tail -f /usr/local/nginx/logs/access.log

10.0.0.47 - - [11/Jun/2022:13:11:33 +0800] "GET / HTTP/1.1" 200 29 "-" "curl/7.29.0" "-"
10.0.0.47 - - [11/Jun/2022:13:11:51 +0800] "GET / HTTP/1.1" 200 29 "-" "curl/7.29.0" "-"
10.0.0.47 - - [11/Jun/2022:13:11:52 +0800] "GET / HTTP/1.1" 200 29 "-" "curl/7.29.0" "-"
10.0.0.47 - - [11/Jun/2022:13:11:53 +0800] "GET / HTTP/1.1" 200 29 "-" "curl/7.29.0" "-"

proxy

[root@proxy2 ~]#tail -f  /var/log/nginx/access.log

10.0.0.57 - - [11/Jun/2022:13:11:33 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47"
10.0.0.57 - - [11/Jun/2022:13:11:51 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47"
10.0.0.57 - - [11/Jun/2022:13:11:52 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47"
10.0.0.57 - - [11/Jun/2022:13:11:53 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47"     #代理添加的报文首部字段

httpd

[root@httpd ~]#tail -f /var/log/httpd/access_log
10.0.0.8 - - [11/Jun/2022:13:11:33 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47, 10.0.0.57"
10.0.0.8 - - [11/Jun/2022:13:11:51 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47, 10.0.0.57"
10.0.0.8 - - [11/Jun/2022:13:11:52 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47, 10.0.0.57"
10.0.0.8 - - [11/Jun/2022:13:11:53 +0800] "GET / HTTP/1.0" 200 29 "-" "curl/7.29.0" "10.0.0.47, 10.0.0.57"  #代理服务器添加的报文首部字段  IP地址