How to restore original client IP from Cloudflare with NGINX ingress controller

问题

I'm using Cloudflare as CDN and it's hiding the real IP address for the clients I'm using an NGINX ingress controller as a loadbalancer running in Google Kubernetes engine So I'm trying to restore the original IP address and trying to follow this link https://support.cloudflare.com/hc/en-us/articles/200170706-How-do-I-restore-original-visitor-IP-with-Nginx- How can I implement this in the configmap for my Nginx ingress since I need multiple value for the same key "set-real-ip-from" ?

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingressname
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-name: "route"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
spec:
  tls:
  - hosts:
    - example.com
    secretName: sslcertificate
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: service
          servicePort: 80
        path: /

回答1:

I also had this problem and it took me forever to fix but apparently all I needed was this configuration:

apiVersion: v1
data:
  # Cloudflare IP ranges which you can find online
  proxy-real-ip-cidr: "173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32"
  # This is the important part
  use-forwarded-headers: "true"
  # Still works without this line because it defaults to X-Forwarded-For, but I use it anyways
  forwarded-for-header: "CF-Connecting-IP"
kind: ConfigMap
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

IMO this is all really unclear from the documentation. I had to search through tons of issues and the actual template file itself to figure it out.

回答2:

In order to retrieve data from X-Forwarded-For header and get a real IP address for the clients you have to enable proxy protocol in particular Nginx Ingress controller ConfigMap and then add IP/networks for a visitors.

apiVersion: v1
data:
  proxy-real-ip-cidr: 103.21.244.0/22,103.22.200.0/22,103.31.4.0/22
  use-proxy-protocol: "true"
kind: ConfigMap
metadata:
  labels:
    app: nginx-ingress
  name: nginx-ingress-controller
  namespace: default

Hope this will help you!

来源：https://stackoverflow.com/questions/56489147/how-to-restore-original-client-ip-from-cloudflare-with-nginx-ingress-controller

标签

Docker

nginx

Kubernetes

google-kubernetes-engine

cloudflare