How to configure and use proxy protocol in nginx

proxy protocol is applied in nginx

We know that nginx is a web server and proxy server. It generally works in proxy server or load balancing software (Haproxy , behind Amazon Elastic Load Balancer (ELB).

First, the client initiates a request to the proxy server or load balancing software, and then the request will be forwarded to nginx for actual web access.

Because it has gone through multiple layers of software, some information on the client such as IP address, port number, etc. may be hidden, which is detrimental to our problem analysis and data statistics. We hope to obtain the real IP address of the client in order to obtain Accurate request environment.

In this case, you need to use the PROXY protocol.

If the proxy or LSB mentioned above implement the PROXY protocol, whether it is HTTP or SSL , HTTP/2, SPDY, WebSocket or TCP protocol, nginx can get the original IP address of the client and perform some special operations based on the original IP address, such as blocking access from malicious IPs and displaying different languages ​​or pages based on different IPs. , or simpler logging and statistics, etc., are very effective.

Of course, if you want to support PROXY protocol, there are also requirements for the nginx version. The specific version requirements are as follows:

• To support PROXY protocol v2, you need NGINX Plus R16 or NGINX Open Source 1.13.11.

• To support ROXY protocol for HTTP, you need NGINX Plus R3 or NGINX Open Source 1.5.12.

• To support TCP client‑side PROXY protocol, NGINX Plus R7 or NGINX Open Source 1.9.3 is required.

• To support PROXY protocol for TCP, you need NGINX Plus R11 or NGINX Open Source 1.11.4.

In nginx, you can obtain the corresponding client information through the following variables , specifically as follows:

$proxy_protocol_addr and $proxy_protocol_port represent the IP address and port number of the original client respectively.

$remote_addr and $remote_port represent the IP address and port of the load balancer.

If you use the RealIP extension module, then this module will rewrite the two values ​​​​of $remote_addr and $remote_port, replacing them with the IP address and port number of the original client.

Then use $realip_remote_addr and $realip_remote_port to represent the IP address and port of the load balancer.

In the RealIP extension module, the meaning of $proxy_protocol_addr and $proxy_protocol_port remains unchanged, which is still the IP address and port number of the original client.

Configuring and using proxy protocol in nginx

We mentioned above the basic application of proxy protocol in nginx. Let’s talk about how to perform specific configuration in nginx.

Enable proxy protocol in nginx

If your nginx is already a version that supports proxy protocol, then enabling proxy protocol is very simple. You only need to add proxy_protocol to the listen in the server. As shown below:

http {
    #...
    server {
        listen 80   proxy_protocol;
        listen 443  ssl proxy_protocol;
        #...
    }
}
   
stream {
    #...
    server {
        listen 112233 proxy_protocol;
        #...
    }
}

Everyone is more familiar with the http block. In nginx, it represents support for http/https. Nginx provides support for the TCP/UDP protocol. This function is implemented through the stream module, which is relatively unfamiliar to many people.

Through the above configuration, nginx can support proxy protocol in both tcp/udp protocol and http/https protocol.

Using Real‑IP modules

Real‑IP modules is a module that comes with nginx. You can use the following command to check whether nginx has the real-ip module installed:

nginx -V 2>&1 | grep -- 'http_realip_module'
nginx -V 2>&1 | grep -- 'stream_realip_module'

If the version you are currently using does not have real ip, don't worry, you may need to compile from the source code at this time.

During the compilation process, we need to execute a configure command. In this configure command, you can specify the functions to be enabled, such as stream or http_ssl_module:

$ ./configure
--sbin-path=/usr/local/nginx/nginx
--conf-path=/usr/local/nginx/nginx.conf
--pid-path=/usr/local/nginx/nginx.pid
--with-pcre=../pcre-8.44
--with-zlib=../zlib-1.2.11
--with-http_ssl_module
--with-stream
--with-mail

If you want to enable the real-ip function , you can add:

--with-http_realip_module

If nginx is running behind SLB or proxy, you can use the set_real_ip_from command to specify the IP range of the proxy or load balancing server, as follows:

server {
    #...
    set_real_ip_from 192.168.1.0/24;
   #...
}

Then we need to replace the IP address of the proxy or SLB with the address of the real client, then we can use it like this:

http {
    server {
        #...
        real_ip_header proxy_protocol;
      }
}

Request forwarding

Whether it is http or stream block, you may encounter the request direction For subsequent upstream forwarding, for upstream, they hope to receive the real client IP address instead of the proxy or slb address. This can be solved by the following settings:

http {
    proxy_set_header X-Real-IP       $proxy_protocol_addr;
    proxy_set_header X-Forwarded-For $proxy_protocol_addr;
}

stream {
    server {
        listen 12345;
        proxy_pass example.com:12345;
        proxy_protocol on;
    }
}

http The setting method of stream is different.

Logging

Log is a very important function. It is very useful for locating problems and performing statistical analysis of data. Of course, what we need is the real client IP address.

We can record the corresponding logs in the http and stream block by using the variable $proxy_protocol_addr, as shown below:

http {
    #...
    log_format combined '$proxy_protocol_addr - $remote_user [$time_local] '
                        '"$request" $status $body_bytes_sent '
                        '"$http_referer" "$http_user_agent"';
}

stream {
    #...
    log_format basic '$proxy_protocol_addr - $remote_user [$time_local] '
                      '$protocol $status $bytes_sent $bytes_received '
                      '$session_time';
}

The above is the detailed content of How to configure and use proxy protocol in nginx. For more information, please follow other related articles on the PHP Chinese website!