2019-10-14 day48 透传真实ip

透传真实ip

1.基于代理（七层负载均衡）情况下   透传客户端真实IP
     http  https    url    安全
     
环境：
    10.0.0.5  proxy_node1
    10.0.0.6  proxy_node2
    10.0.0.7  proxy_node3
    10.0.0.8  webserver

域名:
    ip.oldboy.com     解析到10.0.0.5
proxy_node1   配置如下
    [root@lb01 conf.d]# cat ip.oldboy.com.conf 
server {
    listen 80;
    server_name ip.oldboy.com;

    location / {
        proxy_pass http://10.0.0.6;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}

proxy_node2   配置如下

    [root@lb01 conf.d]# cat ip.oldboy.com.conf 
server {
    listen 80;
    server_name ip.oldboy.com;

    location / {
        proxy_pass http://10.0.0.7;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}

proxy_node3   配置如下
    [root@lb01 conf.d]# cat ip.oldboy.com.conf 
server {
    listen 80;
    server_name ip.oldboy.com;

    location / {
        proxy_pass http://10.0.0.8;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}

werserver 配置如下

[root@web02 conf.d]# cat ip.oldboy.com.conf 
server {
    listen 80;
    server_name ip.oldboy.com;
    root /code;
    
    location / {
        index index.php index.html;
}
    location ~ \.php$ {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
}
}

准备PHP代码，提取真实IP
[root@web02 code]# cat ./index.php 
[root@web02 code]# cat index.php 


index.html 
ip.oldboy.com
劫持：
10.0.0.5  ip.oldboy.com

image.png

测试方法一 搜索x_for

image.png

测试方法二 抓包

image.png

proxy_node1 代理的日志

10.0.0.1 - - [03/Oct/2019:14:45:15 +0800]

proxy_node2 代理的日志

10.0.0.5 - - [03/Oct/2019:14:45:14 +0800]  GET / HTTP/1.1" 200  "10.0.0.1"

proxy_node3 代理的日志

10.0.0.6 - - [03/Oct/2019:14:45:15 +0800]  GET / HTTP/1.1" 200  "10.0.0.1, 10.0.0.5"

webserver代理的日志

10.0.0.7 - - [03/Oct/2019:14:45:15 +0800] "GET / HTTP/1.1" 200 95442 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36" "10.0.0.1, 10.0.0.5, 10.0.0.6"

使用nginx Realip_module获取多级代理下的客户端真实ip地址，需要在web

上配置

set_real_ip_from 10.0.0.5;

set_real_ip_from 10.0.0.6;

set_real_ip_from 10.0.0.7;

real_ip_header X_Forwarded-For;

real_ip_recursive on;

[root@web02 conf.d]# cat ip.oldboy.com.conf 
server {
    listen 80;
    server_name ip.oldboy.com;
    root /code;


    set_real_ip_from   10.0.0.5;
    set_real_ip_from   10.0.0.6;
    set_real_ip_from   10.0.0.7;
    real_ip_header   X-Forwarded-For;
    #real_ip_recursive on;
    
    location / {
        index index.php index.html;
}
    location ~ \.php$ {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
}
}

image.png

最后webserver的结果
10.0.0.1 - - [03/Oct/2019:15:23:20 +0800] "GET /index.php HTTP/1.1" 200 65 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36" "10.0.0.1, 10.0.0.5, 10.0.0.6"