Nginx企业实战-当有反向代理，nginx服务器如何获取真实的客户端ip

曾经终败给现在 2023-07-12 05:15 30阅读 0赞

**当服务器有反向代理时，服务器不知道访问的客户端的真实ip，这个实验目的就是获取真实的客户端ip**

此实验需要三台虚拟机：

<table> 
 <thead> 
  <tr> 
   <th>虚拟机名称</th> 
   <th>ip</th> 
   <th>作用</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>server1</td> 
   <td>172.25.1.1</td> 
   <td>nginx服务器</td> 
  </tr> 
  <tr> 
   <td>server2</td> 
   <td>172.25.1.2</td> 
   <td>server1的代理</td> 
  </tr> 
  <tr> 
   <td>server3</td> 
   <td>172.25.1.3</td> 
   <td>客户端</td> 
  </tr> 
 </tbody> 
</table>

1.在server1和server2安装nginx

注意：server1安装的nginx必须有`--with-http_realip_module`模块  
2.配置反向代理服务器  
在server2：  
编辑nginx的配置文件

[root@server2 conf]# pwd
    /usr/local/nginx/conf
    [root@server2 conf]# vim nginx.conf
    添加20,21行内容，56-64行内容
     http { 
     18     include       mime.types;
     19     default_type  application/octet-stream;
     20             upstream westos{ 
     21                  server 172.25.1.1:80;
     22               }
    ......
     56      server { 
     57                  listen 80;
     58                  server_name  www.westos.org;
     59                  location / { 
     60                         proxy_pass http://westos;
     61                       }
     62         }
     63

检查nginx配置文件并启动：

[root@server2 conf]# nginx -t
    nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    [root@server2 conf]# nginx

此时已经实现了server2对server1 的代理，在server3做解析并测试：

[root@server3 ~]# cat /etc/hosts
    172.25.1.2	server2 www.westos.org
    [root@server3 ~]# curl www.westos.org
    server1							#成功实现代理
    [root@server3 ~]# curl www.westos.org
    server1
    [root@server3 ~]# curl www.westos.org
    server1

此时查看nginx服务器（server1）的日志：

[root@server1 conf]# cat /usr/local/nginx/logs/access.log 
    .....
    172.25.1.2 - - [07/Mar/2020:11:20:49 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.2 - - [07/Mar/2020:11:20:52 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.2 - - [07/Mar/2020:11:20:54 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.2 - - [07/Mar/2020:11:22:23 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.2 - - [07/Mar/2020:11:22:24 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"

可以看出nginx服务器只知道代理服务器的ip地址，而不知道客户端的ip地址，想要知道客户端的ip地址需要在nginx服务器进行如下设置：

3.配置nginx服务器

在server1：

[root@server1 conf]# vim nginx.conf
    
     36     server { 
     37         listen       80;
     38         server_name  localhost;
     39 
     40         set_real_ip_from 172.25.1.2;				#反向代理服务器的ip
     41         real_ip_header X-Forwarded-For;				#保留每一级的报文头
     42         real_ip_recursive on;
     43         #charset koi8-r;

重新加载nginx：

[root@server1 conf]# nginx -t
    nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    [root@server1 conf]# nginx -s reload

4.配置反向代理服务器

[root@server2 conf]# vim nginx.conf
    
    118         server { 
    119                 listen 80;
    120                 server_name www.westos.org;
    121 
    122                 location / { 
    123                         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    124                         proxy_pass http://westos;
    125                 }
    126         }

重新加载nginx：

5.测试

此时在客户端（server3）：

[root@server3 ~]# curl www.westos.org
    server1
    [root@server3 ~]# curl www.westos.org
    server1
    [root@server3 ~]# curl www.westos.org
    server1

查看server1（nginx服务器）的日志：

[root@server1 conf]# cat /usr/local/nginx/logs/access.log 
    .....
    172.25.1.3 - - [07/Mar/2020:11:28:00 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.3 - - [07/Mar/2020:11:28:00 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.3 - - [07/Mar/2020:11:28:01 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.3 - - [07/Mar/2020:11:28:02 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"
    172.25.1.3 - - [07/Mar/2020:11:28:02 +0800] "GET / HTTP/1.0" 200 8 "-" "curl/7.29.0"