diff --git a/inner-proxy/conf/conf.d/default.conf b/inner-proxy/conf/conf.d/default.conf index f58c459..0a41c4a 100644 --- a/inner-proxy/conf/conf.d/default.conf +++ b/inner-proxy/conf/conf.d/default.conf @@ -15,9 +15,11 @@ server { } location / { - proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + proxy_set_header X-Forwarded-For $realip_add_x_forwarded_for; + proxy_set_header X-Bad-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Real-IP $remote_addr; + proxy_pass http://backend; } } diff --git a/inner-proxy/conf/lua/realip-x-forwarded-for.lua b/inner-proxy/conf/lua/realip-x-forwarded-for.lua new file mode 100644 index 0000000..1c6a9f0 --- /dev/null +++ b/inner-proxy/conf/lua/realip-x-forwarded-for.lua @@ -0,0 +1,11 @@ +local _M = {} + +function _M.run() + if (ngx.var.http_x_forwarded_for == "" or ngx.var.http_x_forwarded_for == nil) then + ngx.var.realip_add_x_forwarded_for = ngx.var.realip_remote_addr + else + ngx.var.realip_add_x_forwarded_for = ngx.var.http_x_forwarded_for .. ", " .. ngx.var.realip_remote_addr + end +end + +return _M diff --git a/inner-proxy/conf/nginx.conf b/inner-proxy/conf/nginx.conf index 6f422e1..883e275 100644 --- a/inner-proxy/conf/nginx.conf +++ b/inner-proxy/conf/nginx.conf @@ -30,6 +30,11 @@ http { set_real_ip_from 10.20.30.2/32; real_ip_header X-Forwarded-For; + map $request $realip_add_x_forwarded_for { default ""; } + access_by_lua_block { + require("realip-x-forwarded-for").run() + } + # Include the rest of the configuration include conf.d/*.conf; }