Nginx Real IP
当前端有nginx进行反向代理时,后端的机器获得的访问日志中记录的IP是前端nginx的,用一下方法来记录真实IP。
实验环境
node1:192.168.174.129 前端代理(nginx-proxy) centos 6.5
node2:192.168.174.128 后端服务(nginx) centos 6.5
实验过程
- nginx安装realip_module模块(两个nginx都要安装)
#检查nginx是否安装了realip_module
nginx -V
[root@node1 ~]# nginx -V
nginx version: nginx/1.4.4
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-11) (GCC)
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/alidata/server/nginx --with-http_stub_status_module --without-http-cache --with-http_ssl_module --with-http_gzip_static_module
#增加realip_module,找到nginx的源码,重新编译,在编译参数中加入--with-http_realip_module
[root@node1 nginx-1.4.4]# ./configure --user=www --group=www --prefix=/alidata/server/nginx --with-http_stub_status_module --without-http-cache --with-http_ssl_module --with-http_gzip_static_module --with-http_realip_module
#之后,只需make即可,不要make install
[root@node1 nginx-1.4.4]# make
#将新的nginx替换老的nginx sbin文件(可能需要停止nginx服务)。重启nginx服务
[root@node1 nginx-1.4.4]# cp objs/nginx /alidata/server/nginx/sbin/
- 在nginx代理机器修改配置文件 (192.168.174.129)
#在server段的配置中:
server {
listen 80;
server_name _;
location ^~ /xing/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://192.168.174.128/;
}
access_log /alidata/log/nginx/access/test.log;
}
- 修改后端nginx的日志格式。(192.168.174.128)
#在nginx.conf中:
log_format test '$http_x_real_ip - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
#在server段配置log
access_log /alidata/log/nginx/access/zabbix.log test;
测试
访问http://192.168.174.129/xing/ ,观察node2机器的日志。
192.168.174.1 - - [24/Sep/2015:22:52:38 +0800] "GET /images/general/zabbix.ico HTTP/1.0" 200 1150 "http://192.168.174.129/xing/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "192.168.174.1"