当前位置：首页 > news >正文

实战指南：HAProxy 七层与四层源 IP 透传配置详解

news 2026/8/6 4:33:31

web服务器中需要记录客户端的真实IP地址，用于做访问统计、安全防护、行为分析、区域排行等场景

七层IP透传

#实验环境[root@haproxy ~]# vim /etc/haproxy/haproxy.cfglisten webclusterbind*:80 balance roundrobin server haha192.168.0.10:80 check inter 3s fall3rise5weight1server hehe192.168.0.20:80 check inter 3s fall3rise5weight1[root@haproxy ~]# systemctl restart haproxy.service#测试环境[Administrator.DESKTOP-VJ307M3]➤foriin{1..5}>do>curl172.25.254.100>donewebserver1 -192.168.0.10 webserver2 -192.168.0.20 webserver1 -192.168.0.10 webserver2 -192.168.0.20 webserver1 -192.168.0.10#在apache主机中默认是未开启透传功能的/nginx默认开启ip透传[root@webserver2 ~]# cat /etc/httpd/logs/access_log192.168.0.100 - -[26/Jan/2026:10:03:03 +0800]"GET / HTTP/1.1"20026"-""curl/7.65.0"192.168.0.100 - -[26/Jan/2026:10:03:03 +0800]"GET / HTTP/1.1"20026"-""curl/7.65.0"#开启ip透传的方式[root@haproxy ~]# vim /etc/haproxy/haproxy.cfg。。。忽略。。。。。 defaults mode http log global option httplog option dontlognull option http-server-close option forwardfor except127.0.0.0/8#开启haproxy透传功能option redispatch retries3timeouthttp-request 10stimeoutqueue 1mtimeoutconnect 10stimeoutclient 1mtimeoutserver 1mtimeouthttp-keep-alive 10stimeoutcheck 10s maxconn3000#在Apache中设定采集透传IP[root@webserver2 ~]# vim /etc/httpd/conf/httpd.conf201LogFormat"%h %l %u %t\"%r\"%>s %b\"%{X-Forwarded-For}i\"\"%{Referer}i\"\"%{User-Agent}i\""combined[root@webserver2 ~]# systemctl restart httpd#测试效果[root@webserver2 ~]# cat /etc/httpd/logs/access_log192.168.0.100 - -[26/Jan/2026:10:10:29 +0800]"GET / HTTP/1.1"20026"172.25.254.1""-""curl/7.65.0"192.168.0.100 - -[26/Jan/2026:10:10:30 +0800]"GET / HTTP/1.1"20026"172.25.254.1""-""curl/7.65.0"192.168.0.100 - -[26/Jan/2026:10:10:30 +0800]"GET / HTTP/1.1"20026"172.25.254.1""-""curl/7.65.0"

四层IP透传

#环境设置#RS1中部署apache[root@webserver1 ~]# dnf install httpd -y[root@webserver1 ~]# echo RS2 - 192.168.0.10 > /var/www/html/index.html[root@webserver1 ~]# systemctl enable --now httpd#在RS2中部署nginx#部署nginx[root@webserver2 ~]# dnf install nginx -y[root@webserver2 ~]# echo RS2 - 192.168.0.20 > /usr/share/nginx/html/index.html[root@webserver2 ~]# systemctl enable --now nginx#测环境[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10#启用apache的四层访问控制[root@node1 ~]# vim /etc/httpd/conf.modules.d/10-proxy_h2.confLoadModule proxy_http2_module modules/mod_proxy_http2.so LoadModule remoteip_module modules/mod_remoteip.so[root@node1 ~]# vim /etc/httpd/conf/httpd.confRemoteIPProxyProtocol on RemoteIPTrustedProxy192.168.0.0/24#直接添加[root@node1 ~]# systemctl restart httpd#启用nginx的四层访问控制[root@webserver2 ~]# vim /etc/nginx/nginx.confserver{listen80proxy_protocol;#启用四层访问控制listen[::]:80;server_name _;root /usr/share/nginx/html;# Load configuration files for the default server block.include /etc/nginx/default.d/*.conf;error_page404/404.html;location=/404.html{}[root@webserver2 ~]# systemctl restart nginx.service#测试Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;done<html><body><h1>502Bad Gateway</h1>The server returned an invalid or incomplete response.</body></html><html><body><h1>502Bad Gateway</h1>The server returned an invalid or incomplete response.</body></html><html><body><h1>502Bad Gateway</h1>The server returned an invalid or incomplete response.</body></html><html><body><h1>502Bad Gateway</h1>The server returned an invalid or incomplete response.</body></html><html><body><h1>502Bad Gateway</h1>The server returned an invalid or incomplete response.</body></html>出现上述报错标识nginx只支持四层访问#设定haproxy访问4层[root@haproxy ~]# vim /etc/haproxy/haproxy.cfglisten webclusterbind*:80 mode tcp#四层访问balance roundrobin server haha192.168.0.10:80 send-proxy check inter 3s fall3rise5weight1server hehe192.168.0.20:80 send-proxy check inter 3s fall3rise5weight1#添加send-proxy[root@haproxy ~]# systemctl restart haproxy.service#测试四层访问[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10#设置4层ip透传[root@webserver1&2~]# vim /etc/nginx/nginx.conflog_format main'$remote_addr - $remote_user [$time_local] "$request" ''"$proxy_protocol_addr"'#采集透传信息'$status $body_bytes_sent "$http_referer" ''"$http_user_agent" "$http_x_forwarded_for"';[root@webserver1&2~]# systemctl restart nginx.service#测试[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20[root@webserver1 ~]# cat /var/log/nginx/access.log192.168.0.100 - -[26/Jan/2026:10:52:40 +0800]"GET / HTTP/1.1""172.25.254.1"20019"-""curl/7.65.0""-"192.168.0.100 - -[26/Jan/2026:10:53:49 +0800]"GET / HTTP/1.1""172.25.254.1"20019"-""curl/7.65.0""-"192.168.0.100 - -[26/Jan/2026:10:53:50 +0800]"GET / HTTP/1.1""172.25.254.1"20019"-""curl/7.65.0""-"192.168.0.100 - -[26/Jan/2026:10:53:50 +0800]"GET / HTTP/1.1""172.25.254.1"20019"-""curl/7.65.0""-"