<- Back

Nginx配置 http从stream中获取真实客户端ip

Created at 2020-09-26 20:07:47

Last updated at 2020-09-26 20:07:47

2984 Clicks

将nginx作为trojan的前置端,使用nginx控制是否转发给trojan,还是转发给http服务。
其中分发的原来请自行搜索学习。

配置使用了nginx的stream等模块,在Ubuntu 20.04上的Nginx v.1.18.0(来自nginx官方apt源),所需的模块都启用了。

理论上就是通过proxy_protocol从stream将客户端ip传给http,在http的log_format中,将remote_addr更换成proxy_protocol_addr即可。

proxy_protocol在使用时注意,在输出时,使用"proxy_protocol on;"来配置,接受时在listen的末尾加上”proxy_protocol“即可。

但是trojan在接收tcp时,不能处理proxy_protocol,所以在转发给trojan之前,需要再将proxy_protocol去掉,只需多一步转发即可。

具体配置nginx.conf开头内容如下:

stream {
    log_format basic '$remote_addr - $remote_user [$time_local] '
                     '$protocol $status $bytes_sent $bytes_received '
                     '$session_time';
    map $ssl_preread_server_name $backend {
        trojan6.domain.com unix:/run/nginx-trojan-stream.sock;
        trojan.domain.com unix:/run/nginx-trojan-stream.sock;
        default 127.0.0.1:443;
    }
    server {
        listen unix:/run/nginx-trojan-stream.sock proxy_protocol;
        proxy_pass 127.0.0.1:8443;
    }
    server {
        listen 0.0.0.0:443;
        listen [::]:443;
        proxy_pass $backend;
        ssl_preread on;
        proxy_protocol on;
    }
}

http {
    log_format combined '$proxy_protocol_addr - $remote_user [$time_local] '
                        '"$request" $status $body_bytes_sent '
                        '"$http_referer" "$http_user_agent"';
    server {
        listen 127.0.0.1:80 proxy_protocol;
        listen [::1]:443 ssl proxy_protocol;
        ...
    }
}

Tags:ITNetworkUbuntuLinuxtrojanproxy

59 Comments

DwainWrape (urielorocksh3jellyandra@free-private-mail.com)
#106

I can not take part now in discussion - it is very occupied. I will be free - I will necessarily wri

Created at 2022-09-30 09:58:41

creannown (creannown@newonlinemail.xyz)
#105

31 Fig 3A , respectively, which fall within a 95 credible interval of the ratio of the medians in th

Created at 2022-09-26 10:43:11

Isabellalync (isabellalync@mailfence.com)
#104

Ніǃ Ι've nоtіced thаt mаny guyѕ рrefk

Created at 2022-09-21 14:21:00

Keguige (Keguige@beaumail.xyz)
#103

I then had so many various treatments including a bloodtest to see what I am compatible with and now

Created at 2022-09-21 09:35:26

Dryday (alexanderivanov125vl@gmail.com)
#102

Таможенный импортер «ВЭД ЛАЙН» не только предоставляет услуги перевозок грузов из Китайской Народной

Created at 2022-09-18 12:52:23

@ 2019-2022 OWENDSWANG
Contact me: owendswang@qq.com