Nginx 四层反代 QUIC 如何传递客户端 IP

REMOTE_ADDR: 127.0.0.1
HTTP_CLIENT_IP: 未设置
HTTP_X_FORWARDED_FOR: 未设置
HTTP_X_REAL_IP: 未设置
HTTP_FORWARDED: 未设置
HTTP_FORWARDED_FOR: 未设置
HTTP_X_FORWARDED: 未设置

四层 stream 配置

map $ssl_preread_server_name $name {
    default default_backend;
}

upstream default_backend {
    server 127.0.0.1:6443; # 站点
}

server {
    listen 443 reuseport;
    listen 443 udp reuseport;
    proxy_pass $name;
    ssl_preread on;
    proxy_protocol on;
}

站点配置

server
{
    listen 80;
    listen 6443 ssl  proxy_protocol ;
    listen 6443 quic reuseport;
		
    http2 on;
    server_name abc.com www.abc.com;
    
    index index.php index.html;
    root /wwwroot/abc.com;
    
    set_real_ip_from 127.0.0.1;
    real_ip_header proxy_protocol;
    
    ...
}

第 1 条附言 · 30 天前

nginx version: nginx/1.27.1
built by gcc 12.2.0 (Debian 12.2.0-14)
built with OpenSSL 1.1.1q 5 Jul 2022
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/www/server/nginx --add-module=/www/server/nginx/src/ngx_devel_kit --add-module=/www/server/nginx/src/lua_nginx_module --add-module=/www/server/nginx/src/ngx_cache_purge --with-openssl=/www/server/nginx/src/openssl --with-pcre=pcre-8.43 --with-http_v2_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_stub_status_module --with-http_ssl_module --with-http_image_filter_module --with-http_gzip_static_module --with-http_gunzip_module --with-ipv6 --with-http_sub_module --with-http_flv_module --with-http_addition_module --with-http_realip_module --with-http_mp4_module --with-http_auth_request_module --add-module=/www/server/nginx/src/ngx_http_substitutions_filter_module-master --with-ld-opt=-Wl,-E --with-cc-opt=-Wno-error --with-ld-opt=-ljemalloc --with-http_dav_module --add-module=/www/server/nginx/src/nginx-dav-ext-module --with-http_v3_module

QUIC

Nginx

proxy_protocol

14 条回复 • 2025-03-17 10:15:18 +08:00

dabao

30 天前

```
nginx version: nginx/1.27.1
built by gcc 12.2.0 (Debian 12.2.0-14)
built with OpenSSL 1.1.1q 5 Jul 2022
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/www/server/nginx --add-module=/www/server/nginx/src/ngx_devel_kit --add-module=/www/server/nginx/src/lua_nginx_module --add-module=/www/server/nginx/src/ngx_cache_purge --with-openssl=/www/server/nginx/src/openssl --with-pcre=pcre-8.43 --with-http_v2_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_stub_status_module --with-http_ssl_module --with-http_image_filter_module --with-http_gzip_static_module --with-http_gunzip_module --with-ipv6 --with-http_sub_module --with-http_flv_module --with-http_addition_module --with-http_realip_module --with-http_mp4_module --with-http_auth_request_module --add-module=/www/server/nginx/src/ngx_http_substitutions_filter_module-master --with-ld-opt=-Wl,-E --with-cc-opt=-Wno-error --with-ld-opt=-ljemalloc --with-http_dav_module --add-module=/www/server/nginx/src/nginx-dav-ext-module --with-http_v3_module
```