haproxy- IP透传

        web服务器中需要记录客户端的真实IP地址，用于做访问统计、安全防护、行为分析、区域排行等场景。

一：七层IP透传

1.1：当未开启透传

mode中使用http为七层，属于七层透传

[root@localhost ~]# vim /etc/haproxy/haproxy.cfg

关闭透传功能

重启服务

[root@localhost ~]# systemctl restart haproxy.service 

使用window终端进行访问主机ip地址（172.25.254.129）

[root@localhost ~]# curl 172.25.254.129

在172.25.254.10上可以查看访问日志

[root@localhost ~]# cat  /var/log/nginx/access.log

在此日志中是无法看到真实访问源地址的

[root@localhost ~]# cat  /var/log/nginx/access.log
172.25.254.129 - - [12/Aug/2024:10:50:09 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "-"
172.25.254.129 - - [12/Aug/2024:10:50:17 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "-"

1.2：开启透传

再次使用window终端进行访问主机ip地址（172.25.254.129）

在172.25.254.10上可以查看访问日志

[root@localhost ~]# cat  /var/log/nginx/access.log

172.25.254.129 - - [12/Aug/2024:10:50:09 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "-"
172.25.254.129 - - [12/Aug/2024:10:50:17 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "-"
172.25.254.129 - - [12/Aug/2024:10:50:17 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "172.25.254.1"

客户端（172.25.254.10）安装阿帕奇，在访问日志中通过变量$proxy_protocol_addr 记录透传过来的客户端IP        

开启服务

[root@localhost ~]# systemctl restart httpd.service
给予测试页

[root@localhost ~]# echo webserver1 - 172.25.254.10 > /var/www/html/index.html

再次使用window终端进行访问主机ip地址（172.25.254.129）

在172.25.254.10上可以查看访问日志

[root@localhost ~]# cat  /var/log/nginx/access.log

172.25.254.129 - - [12/Aug/2024:10:50:09 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "-"
172.25.254.129 - - [12/Aug/2024:10:50:17 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "-"
172.25.254.129 - - [12/Aug/2024:10:50:17 +0800] "GET / HTTP/1.1" xx0 16 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; zh-CN) WindowsPowerShell/x" "172.25.254.1"

发现没有新的日志产生

在172.25.254.10上进入配置文件，插入%{X-Forwarded-For}i

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf

重新启动

[root@localhost ~]# systemctl restart httpd.service
查看日志如下：

[root@rs1 ~]# tail -n 3 /var/log/nginx/access.log
"172.25.254.10, 192.168.0.10" 192.168.0.10 - - [10/Jul/2024:16:15:00 +0800] "GET
/ HTTP/1.1"200 18 "-" "curl/7.29.0" "172.25.254.10"

[root@rs2 ~]# tail -n 3 /etc/httpd/logs/access_log
172.25.254.10 192.168.0.10 - - [11/Jul/2024:00:15:00 +0800] "GET / HTTP/1.1" 200
27 "-" "curl/7.29.0"

二：四层IP透传

将mode中的http改为tcp

[root@localhost ~]# vim /etc/haproxy/haproxy.cfg 

加上限定参数：send-porxy

重新启动服务

[root@localhost ~]# systemctl restart haproxy

[root@localhost ~]# vim /etc/nginx/nginx.conf

192.168.0.10 - - [10/Jul/2024:15:21:00 +0800] "GET / HTTP/1.1"200 18 "-"
"curl/7.29.0" "-"
192.168.0.10 - - [10/Jul/2024:15:26:11 +0800] "GET / HTTP/1.1"200 18 "-"
"curl/7.29.0" "-"
192.168.0.10 - - [10/Jul/2024:15:41:56 +0800] "GET / HTTP/1.1" "172.25.254.10"200
18 "-" "curl/7.29.0"

重新启动服务

[root@localhost ~]# systemctl restart nginx.service 
查看日志内容

192.168.0.10 - - [10/Jul/2024:15:21:00 +0800] "GET / HTTP/1.1"200 18 "-"
"curl/7.29.0" "-"
192.168.0.10 - - [10/Jul/2024:15:26:11 +0800] "GET / HTTP/1.1"200 18 "-"
"curl/7.29.0" "-"
192.168.0.10 - - [10/Jul/2024:15:41:56 +0800] "GET / HTTP/1.1" "172.25.254.10"200
18 "-" "curl/7.29.0"