nginx - nginx反向代理发送客户端IP而不是服务器IP

Question

我正在尝试使用nginx作为Elasticsearch集群的代理(将Kibana用于Logstash)。我的elasticsearch ndoes位于F5负载平衡器的后面，我想使用iRule丢弃除我的nginx IP之外的所有流量。发生的是，我将通过get连接到nginx前端的计算机的IP传递给了Elasticsearch，而不是nginx IP。

我尝试将proxy_bind选项与nginx服务器的IP一起使用，但存在相同的问题。我的配置在下面，有人可以帮忙吗？

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log;
#error_log  /var/log/nginx/error.log  notice;
#error_log  /var/log/nginx/error.log  info;

pid        /run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    index   index.html index.htm;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {

            listen              80;
            server_name         logstash.domain.com;

        #charset koi8-r;

        #access_log  /var/log/nginx/host.access.log  main;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
        root /var/www/html;
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }

        location ~ ^/_aliases$ {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        proxy_read_timeout 90;
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }

        location ~ ^/.*/_aliases$ {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        proxy_read_timeout 90;
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }

         location ~ ^/_nodes$ {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        proxy_read_timeout 90;
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }

        location ~ ^/.*/_search$ {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        proxy_read_timeout 90;
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }

        location ~ ^/.*/_mapping {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        proxy_read_timeout 90;
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }


        location ~ ^/kibana-int/dashboard/.*$ {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        proxy_read_timeout 90;
        limit_except GET {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }
        }

        location ~ ^/kibana-int/temp.*$ {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        proxy_read_timeout 90;
        limit_except GET {
        proxy_pass http://logstashdbaccess.domain.com:9200;
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/conf.d/kibana.myhost.org.htpasswd;
        }
        }
    }
}

Answer 1

您需要在每个代理通过块中设置这些 header

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $server_name;

否则，rails会认为该请求是从nginx本身发起的，即akas 127.0.0.1