黑帽联盟

标题: 前端varnish让后端nginx获取客户真实ip [打印本页]

作者: 定位 时间: 2017-3-28 23:08
标题: 前端varnish让后端nginx获取客户真实ip
当使用varnish做前端缓存的时候,想要让后端nginx获取客户真实ip,其实方法跟nginx做前端让后端nginx获取客户的真实ip是差不多的,想了解nginx做前端让后端获取客户真实ip请看这篇文章nginx proxy获取用户真实ip.下面我们来看看varnish的做法.

  系统:centos 5.9
  环境:前端varnish
  后端：lnmp

1.先在前端服务器安装varnish
wget http://repo.varnish-cache.org/source/varnish-3.0.0.tar.gz
tar zxf varnish-3.0.0.tar.gz && cd varnish-3.0.0
./configure --prefix=/usr/local/varnish
make && make install

cp /usr/local/varnish/etc/varnish/default.vcl /usr/local/varnish/etc/varnish/default.vcl.old
vi /usr/local/varnish/etc/varnish/default.vcl
backend  www {
.host = "bbs.cnblackhat.com";
.port = "80";
}
#acl
acl purge {
  "localhost";
  "127.0.0.1";
  "192.168.0.0"/24;
}
sub vcl_recv {
      if (req.http.Accept-Encoding) {
         if (req.url ~ "\.(jpg|png|gif|jpeg|flv)$" ) {
            remove req.http.Accept-Encoding;
            remove req.http.Cookie;
         } else if (req.http.Accept-Encoding ~ "gzip") {
            set req.http.Accept-Encoding = "gzip";
         } else if (req.http.Accept-Encoding ~ "deflate") {
            set req.http.Accept-Encoding = "deflate";
         } else {
            remove req.http.Accept-Encoding;
         }
      }
         if (req.http.host ~  "(.*)cnblackhat.com") {
                     set req.backend = www;
               }
         else {
                     error 404 "This website is maintaining or not exist!";
            }
  if (req.request == "PURGE") {
   if (!client.ip ~purge) {
   error 405 "Not Allowed";
}
#.dd.....
return(lookup);
  }
#...GET...url...jpg,png,gif. ..cookie
  if (req.request == "GET"&& req.url ~ "\.(png|gif|jpeg|jpg|ico|swf|css|js|html|htm|gz|tgz|bz2|tbz|mp3|ogg|mp4|flv|f4v|pdf)$") {
      unset req.http.cookie;
  }
#..GET...url.php....cache....
  if (req.request =="GET"&&req.url ~ "\.php($|\?)"){
      return (pass);
  }
# }
#........pipe..
if (req.request != "GET" &&
   req.request != "HEAD" &&
   req.request != "PUT" &&
   req.request != "POST" &&
   req.request != "TRACE" &&
   req.request != "OPTIONS" &&
   req.request != "DELETE") {
      return (pipe);
}
#..GET .HEAD.....
if (req.request != "GET" && req.request != "HEAD") {
      return (pass);
}
if (req.http.Authorization) {
      return (pass);
}
return (lookup);
}
#..url+host hash......
sub vcl_hash {
hash_data(req.url);
if (req.http.host) {
      hash_data(req.http.host);
} else {
      hash_data(server.ip);
}
return (hash);
}
# .....purge .....
sub vcl_hit {
if (req.request == "PURGE") {
   set obj.ttl = 0s;
   error 200 "Purged";
}
return (deliver);
}
sub vcl_fetch {
      if (req.url ~ "\.(jpeg|jpg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|ico|swf|flv|dmg|js|css|html|htm)$") {
               set beresp.ttl = 2d;
               set berespberesp.http.expires = beresp.ttl;
               set beresp.http.Cache-Control = "max-age=172800";
               unset beresp.http.set-cookie;
      }
      if (req.url ~ "\.(dmg|js|css|html|htm)$") {
               set beresp.do_gzip = true;
      }
      if (beresp.status == 503) {
                     set beresp.saintmode = 15s;
      }
}
sub vcl_deliver {
      set resp.http.x-hits = obj.hits ;
      if (obj.hits > 0) {
            set resp.http.X-Cache = "HIT You!";
      } else {
            set resp.http.X-Cache = "MISS Me!";
      }
}

2.修改varnish配置文件
vi /usr/local/varnish/etc/varnish/default.vcl
backend  www {
.host = "bbs.cnblackhat.com";
.port = "80";
}
#acl
acl purge {
  "localhost";
  "127.0.0.1";
  "192.168.0.0"/24;
}
sub vcl_recv {

   remove req.http.X-real-ip;
   set req.http.X-real-ip = client.ip;
   set req.http.X-Forwarded-For = client.ip;

      if (req.http.Accept-Encoding) {
         if (req.url ~ "\.(jpg|png|gif|jpeg|flv)$" ) {
            remove req.http.Accept-Encoding;
            remove req.http.Cookie;
         } else if (req.http.Accept-Encoding ~ "gzip") {
            set req.http.Accept-Encoding = "gzip";
         } else if (req.http.Accept-Encoding ~ "deflate") {
            set req.http.Accept-Encoding = "deflate";
         } else {
            remove req.http.Accept-Encoding;
         }
      }
以下省略.

可以看到我在sub vcl_recv { 下添加3行语句
remove req.http.X-real-ip;
set req.http.X-real-ip = client.ip;
set req.http.X-Forwarded-For = client.ip;

3.修改后端nginx配置
vi /etc/nginx/nginx.conf
在http选项配置中添加下面语句:
set_real_ip_from nginx_proxy_ip/24;
set_real_ip_from nginx_proxy_ip;
real_ip_header X-Real-IP;

例子:
set_real_ip_from 192.168.10.0/24;
set_real_ip_from 192.168.10.6;
real_ip_header X-Real-IP;

4.在后端网站中添加php文件
vi i.php
<?php
echo $_SERVER['REMOTE_ADDR'];

然后把i.php放进你网站根目录下.

5.进行验证
在本地电脑上添加前端hosts,在前端添加后端hosts,然后在本地浏览器上进行访问,如果访问https://bbs.cnblackhat.com/i.php,可以看到本地电脑的ip就说明配置正确的,如果不行,请检查前端varnish和后端nginx是否重启让配置文件生效了的.

欢迎光临黑帽联盟 (https://bbs.cnblackhat.com/)