question: How to get the real Client IP in APISIX #4793
-
|
This feature relies on the Real IP module of Nginx, which is covered in the APISIX-OpenResty script. There are 3 directives in the Real IP module
The following describes how to use these three directives in the specific scenario.
When the Client connects directly to APISIX, no special configuration is needed, APISIX can automatically get the real Client IP.
When using Nginx as a reverse proxy between APISIX and a Client, if you do not configure APISIX for Real IP, the Client IP that APISIX gets is the IP of Nginx, not the real Client IP. To fix this problem, Nginx needs to pass the Client IP, for example: location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://$APISIX_IP:port;
}The Configure in nginx_config:
http:
real_ip_from:
- $Nginx_IP
location /get {
real_ip_header X-Real-IP;
real_ip_recursive off;
set_real_ip_from $Nginx_IP;
}
When using multiple Nginx as a reverse proxy between APISIX and Client, configuration of Nginx1, for example: location /get {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://$Nginx2_IP:port;
}configuration of Nginx2, for example: location /get {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://$APISIX_IP:port;
}The configuration uses So after the Nginx1 and Nginx2 proxies, APISIX gets "X-Forwarded-For" as a proxy path like "Client IP, $Nginx1_IP, $Nginx2_IP". Configure in nginx_config:
http:
real_ip_from:
- $Nginx1_IP
- $Nginx2_IP
real_ip_header: "X-Forwarded-For"
real_ip_recursive: "on"The configuration of
When When the request arrives at APISIX, the value of Finally, in other more complex scenarios, such as having a CDN, LB, etc. between APISIX and Client, it is necessary to understand how the Real IP module works and configure it accordingly in APISIX. |
Beta Was this translation helpful? Give feedback.
Replies: 10 comments 11 replies
-
|
why we create issues like this? |
Beta Was this translation helpful? Give feedback.
-
|
I met this problem too. |
Beta Was this translation helpful? Give feedback.
-
Please reopen this, because, in my case, We need to use ip-restriction, but the client IP is nginx IP but the real client IP. |
Beta Was this translation helpful? Give feedback.
-
I have tried several of these scenarios and they all work fine. If they are not correct, feel free to open a new issue with reproducible use cases. |
Beta Was this translation helpful? Give feedback.
-
|
After I do the following configuration Nginx variable $http_x_forwarded_for: How can I get this IP |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much @tzssangglass I found that Akamai has similar support through the |
Beta Was this translation helpful? Give feedback.
-
|
I use aliyun clb and config it by aliyun help link: https://www.alibabacloud.com/help/zh/doc-detail/54007.htm
|
Beta Was this translation helpful? Give feedback.
-
|
i have tried, but still did't work . thanks |
Beta Was this translation helpful? Give feedback.
-
|
I'm not sure about this, it's the k8s network. @tokers what do you think? |
Beta Was this translation helpful? Give feedback.
-
|
Basically, Kubernetes executes the |
Beta Was this translation helpful? Give feedback.
-
|
@tzssangglass @tokers |
Beta Was this translation helpful? Give feedback.
-
|
You're welcome. I think this problem is generic and it's worth recording it into FAQ. |
Beta Was this translation helpful? Give feedback.
-
|
Apache / Apisix: 2.10.0-alpine, Tencent Cloud CLB, I want to get Real IP, but it is Local IP. |
Beta Was this translation helpful? Give feedback.
-
If you understand the case above, you should know what to do. |
Beta Was this translation helpful? Give feedback.
-
|
@tzssangglass After modification, it now looks correct, but I still can't get the real IP. PS: obtain the IP address in the nginx log
|
Beta Was this translation helpful? Give feedback.
-
|
externalTrafficPolicy: Cluster Changed to：externalTrafficPolicy: Local |
Beta Was this translation helpful? Give feedback.
-
|
My access process is like this Client -> Nginx -> APISIX -> Upstream |
Beta Was this translation helpful? Give feedback.
-
kind: Service
...
annotations:
service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: "your-nlb-id"
service.beta.kubernetes.io/alibaba-cloud-loadbalancer-protocol-port: "tcpssl:444"
service.beta.kubernetes.io/alibaba-cloud-loadbalancer-cert-id: "your-cert-id"
service.beta.kubernetes.io/alibaba-cloud-loadbalancer-proxy-protocol: "on"
spec:
ports:
- name: apisix-gateway
protocol: TCP
port: 443
targetPort: 9181
...
loadBalancerClass: "alibabacloud.com/nlb"
type: LoadBalancer
externalTrafficPolicy: Localkind: ConfigMap
...
data:
config.yaml: >-
apisix:
proxy_protocol:
listen_http_port: 9181
nginx_config:
http:
real_ip_header: proxy_protocol
real_ip_from:
- 127.0.0.1
- "unix:"
- 172.20.0.0/16 # your private subnet CIDR nlb(TCPSSL) + apisix + upstream, |
Beta Was this translation helpful? Give feedback.
-
|
As far as I know, your current architecture is a multi-layer gateway proxy, which is also a method adopted by many companies. You need to place the user's IP on the outermost gateway proxy and pass it on to each gateway with an independent name, such as X-Real-IP? |
Beta Was this translation helpful? Give feedback.
Cover all Akamai manufacturer' IPs in
real_ip_fromby using CIDR, see http://nginx.org/en/docs/http/ngx_http_realip_module.htmlSee if the Akamai manufacturer supports providing the original visitor IP in a special header, Just like CloudFlare provides
CF-Connecting-IPheader, see https://support.cloudflare.com/hc/en-us/articles/200170986