The difference between X-Forwarded-For and the X-Real-ip

The difference between X-Forwarded-For and the X-Real-ip

Environment Configuration:
three agents (lb01: 10.0.0.7, lb02: 10.0.0.8 , lb03: 10.0.0.9)
of a web application server (web: 10.0.0.5)

1.配置官方nginx源并安装（4台都操作）

[root@lb01 ~]# vim /etc/yum.repos.d/nginx.repo 
[root@lb01 ~]# yum install nginx -y

[root@lb01 ~]# nginx -v
nginx version: nginx/1.16.0

2.启动nginx服务加入开机自启（4台都操作）

[root@lb01 ~]# systemctl start nginx
[root@lb01 ~]# systemctl enable nginx
Created symlink from /etc/systemd/system/multi-user.target.wants/nginx.service to /usr/lib/systemd/system/nginx.service.

Uniform definitions of the proxy configuration is stored in the proxy_params easy call

[root@lb01 nginx]# vim /etc/nginx/proxy_params

proxy_http_version 1.1; 
proxy_http_version 1.1;  
proxy_http_version 1.1;  
proxy_set_header Host $http_host;
proxy_set_header X‐Real‐IP $remote_addr; #配置X‐Real‐IP
proxy_set_header X‐Forwarded‐For $proxy_add_x_forwarded_for;#配置 X‐Forwarded‐For

proxy_connect_timeout 30; 
proxy_send_timeout 60; 
proxy_read_timeout 60;    

proxy_buffering on;    
proxy_buffer_size 32k;
proxy_buffers 4 128k;

Configuration Agent

[root@lb01 conf.d]# vim web.oldboy.com.conf 

server {
        listen 80;
        server_name web.oldboy.com;


    location / {
    proxy_pass http://10.0.0.8:80;
    include proxy_params;
    }


}

[root@lb01 conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@lb01 conf.d]# systemctl res
rescue        reset-failed  restart       
[root@lb01 conf.d]# systemctl restart nginx

lb02:

Uniform definitions of the proxy configuration is stored in the proxy_params easy call

[root@lb02 ~]# cd /etc/nginx/conf.d/
[root@lb02 conf.d]# vim /etc/nginx/proxy_params

proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;#配置X-Real-IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;#配置X-Forward-For

proxy_connect_timeout 30;
proxy_send_timeout 60;
proxy_read_timeout 60;

proxy_buffering on;
proxy_buffer_size 32k;
proxy_buffers 4 128k;

[root@lb02 conf.d]# vim web.oldboy.com.conf

server {
        listen 80;
        server_name web.oldboy.com;


    location / {
    proxy_pass http://10.0.0.9:80;
    include proxy_params;
    }


}

[root@lb02 conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@lb02 conf.d]# systemctl restart nginx

lb03:

Uniform definitions of the proxy configuration is stored in the proxy_params easy call

[root@lb03 ~]# cd /etc/nginx/conf.d/
[root@lb03 conf.d]# vim /etc/nginx/proxy_params

proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X‐Real‐IP $remote_addr; #配置X‐Real‐IP
proxy_set_header X‐Forwarded‐For $proxy_add_x_forwarded_for;#配置 X‐Forwarded‐For

proxy_connect_timeout 30;
proxy_send_timeout 60;
proxy_read_timeout 60;

proxy_buffering on;
proxy_buffer_size 32k;
proxy_buffers 4 128k;

[root@lb03 conf.d]# vim web.oldboy.com.conf

server {
        listen 80;
        server_name web.oldboy.com;


    location / {
    proxy_pass http://10.0.0.5:80;
    include proxy_params;
    }


}

[root@lb03 conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@lb03 conf.d]# systemctl restart nginx

web：

[root@web ~]# cd /etc/nginx/conf.d/
[root@web conf.d]# vim web.oldboy.com.conf

server {
        listen 80;
        server_name web.oldboy.com;


    location / {
            root /code;
            index index.html;
    }


}

[root@web conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@web conf.d]# echo "10.0.0.5-web" > /code/index.html
[root@web conf.d]# systemctl restart nginx

[root@web conf.d]# vim /etc/nginx/nginx.conf # 为方便查看日志，将web端的记录日志格式修改下

  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for""$http_x_real_ip"';

打开windows的C:windows\System32\drivers\etc\hosts,配置10.0.0.7   web.oldboy.com.

And then everything can check to see if the cmd parsed from the 10.0.0.7.

As illustrated by: 10.0.0.2 (user) -> 10.0.0.7 -> 10.0.0.8 -> 10.0.0.9 -> 10.0.0.5 (web server)

[root@web conf.d]# tail -f /var/log/nginx/access.log

10.0.0.9 - - [02/Jun/2019:11:54:54 +0800] "GET / HTTP/1.1" 200 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" "10.0.0.7""10.0.0.7"

To sum up: X-Real-ip show only on an agent, do not show the real user ip

X-Forwarded-For all through the show ip route.