You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2021/07/30 01:31:06 UTC

[GitHub] [apisix] tzssangglass opened a new issue #4712: question: How to get the real Client IP in APISIX

tzssangglass opened a new issue #4712:
URL: https://github.com/apache/apisix/issues/4712

This feature relies on the [Real IP](http://nginx.org/en/docs/http/ngx_http_realip_module.html) module of Nginx, which is covered in the [APISIX-OpenResty](https://raw.githubusercontent.com/api7/apisix-build-tools/master/build-apisix-openresty.sh) script.

There are 3 directives in the Real IP module

- set_real_ip_from
- real_ip_header
- real_ip_recursive

The following describes how to use these three directives in the specific scenario.

1. Client -> APISIX -> Upstream

When the Client connects directly to APISIX, no special configuration is needed, APISIX can automatically get the real Client IP.

2. Client -> Nginx -> APISIX -> Upstream

When using Nginx as a reverse proxy between APISIX and a Client, if you do not configure APISIX for Real IP, the Client IP that APISIX gets is the IP of Nginx, not the real Client IP.

To fix this problem, Nginx needs to pass the Client IP, for example:

```nginx
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://$APISIX_IP:port;
}
```

The `proxy_set_header` directive sets the `$remote_addr` variable in the `X-Real-IP` header of the current request (the `$remote_addr` variable gets the real Client IP) and passes it to APISIX. The `$APISIX_IP` means the APISIX IP in real environment.

Configure in `config.yaml` of APISIX, for example:

```yaml
nginx_config:
http:
real_ip_from:
- $Nginx_IP
```

`$Nginx_IP` is the IP of Nginx in the real environment. This configuration transformed by APISIX to `nginx.conf` as

```nginx
location /get {
real_ip_header X-Real-IP;
real_ip_recursive off;
set_real_ip_from $Nginx_IP;
}
```

`real_ip_from` corresponds to `set_real_ip_from` in the Real IP module, `real_ip_recursive` and `real_ip_header` directives have default values in `config-default.yaml`.

`real_ip_header X-Real-IP;` means that the Client IP is in the `X-Real-IP` header, which matches the `proxy_set_header X-Real-IP $remote_addr;` in the Nginx configuration.

`set_real_ip_from` means that `$Nginx_IP` is the IP of the trusted server. APISIX excludes `$Nginx_IP` from the search for the real Client IP. Because for APISIX, this IP is a known trusted server IP and cannot be a Client IP. set_real_ip_from` can be configured in CIDR format, such as 0.0.0.0/24.

3. Client -> Nginx1 -> Nginx2 -> APISIX -> Upstream

![a1387cc9-9c68-4a75-a9c7-258681d37e48](https://user-images.githubusercontent.com/30819887/127586260-ecd3fd23-183c-42d2-b18b-d5a7584ea68a.png)

When using multiple Nginx as a reverse proxy between APISIX and Client, configuration of Nginx1, for example:

```nginx
location /get {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://$Nginx2_IP:port;
}
```

configuration of Nginx2, for example:

```nginx
location /get {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://$APISIX_IP:port;
}
```

The configuration uses `X-Forwarded-For`, which is used to get the real proxy path. When `X-Forwarded-For` is enabled for a proxy service, the IP of the current proxy service will be appended to the end of the `X-Forwarded-For` of each request. The format is client, proxy1, proxy2, separated by commas.

So after the Nginx1 and Nginx2 proxies, APISIX gets "X-Forwarded-For" as a proxy path like "Client IP, $Nginx1_IP, $Nginx2_IP".

Configure in `config.yaml` of APISIX, for example:

```yaml
nginx_config:
http:
real_ip_from:
- $Nginx1_IP
- $Nginx2_IP
real_ip_header: "X-Forwarded-For"
real_ip_recursive: "on"
```

The configuration of `real_ip_from` means that both `$Nginx1_IP` and `$Nginx2_IP` are IPs of trusted servers. How many proxy services there are between Client and APISIX, and the IPs of these proxy services need to be set in `real_ip_from`. This ensures that APISIX does not mistake IPs that appear in the search scope for Client IPs.

`real_ip_header` uses `X-Forwarded-For` and does not use the default value of `config-default.yaml`.

When `real_ip_recursive` is on, APISIX will search the value of `X-Forwarded-For` from right to left, exclude the IPs of the trusted servers, and use the first searched IP as the real Client IP.

When the request arrives at APISIX, the value of `X-Forwarded-For` is `Client IP, $Nginx1_IP, $Nginx2_IP`. Since both `$Nginx1_IP` and `$Nginx2_IP` are IPs of trusted servers, APISIX will continue to look to the left and find that `Client IP` is not the IP of any trusted servers, and determine that it is the real Client IP.

Finally, in other more complex scenarios, such as having a CDN, LB, etc. between APISIX and Client, it is necessary to understand how the Real IP module works and configure it accordingly in APISIX.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org