根据url 调度不同的集群 url.oldxu.com
10.0.0.5
10.0.0.7 /pass
10.0.0.8 /user
#1、web01和web02配置 (只不过代码不一样)
[root@web01 ~]# cd /etc/nginx/conf
[root@web01 conf.d]# cat url.oldxu.com.conf
server {
listen 80;
server_name url.oldxu.com;
root /code;
location / {
index index.html;
}
}
#2、lb配置
[root@lb01 conf.d]# cat proxy_url.oldxu.com.conf
upstream user {
server 172.16.1.8;
}
upstream pass {
server 172.16.1.7;
}
server {
listen 80;
server_name url.oldxu.com;
location / {
proxy_pass http://user;
include proxy_params;
}
location /user {
proxy_pass http://user;
include proxy_params;
}
location /pass {
proxy_pass http://pass;
include proxy_params;
}
}
#3、重启nginx服务
[root@lb01 conf.d]# systemctl restart nginx
根据设备调度不同的集群 ( 浏览器 ) ( 手机 )
10.0.0.5
10.0.0.7 pc
10.0.0.8 phone
#1、所有的web都需要配置
[root@web01 ~]# cd /etc/nginx/conf.d
[root@web01 conf.d]# cat /etc/nginx/conf.d/agent.oldxu.com.conf
server {
listen 80;
server_name agent.oldxu.com;
root /code;
location / {
index index.html;
}
}
#2、代理配置
[root@lb01 ~]# cd /etc/nginx/conf.d
[root@lb01 conf.d]# cat proxy_agent.oldxu.com.conf
upstream pc {
server 172.16.1.7:80;
}
upstream phone {
server 172.16.1.8:80;
}
server {
listen 80;
server_name agent.oldxu.com;
location / {
#默认都走pc
proxy_pass http://pc;
include proxy_params;
default_type text/html;
charset utf-8;
#如果是安卓或iphone,则走phone
if ( $http_user_agent ~* "android|iphone|iPad" ) {
proxy_pass http://phone;
}
#如果是IE浏览器,要么拒绝,要么返回一个好的浏览器下载页面
if ( $http_user_agent ~* "MSIE" ) {
return 200 '<a href="http://download.xuliangwei.com/gitlab-ce-8.3.4-ce.0.el7.x86_64.rpm" target="_blank">点击下载正版浏览器google.exe</a>';
}
}
}
多级负载下透传真实ip
#1、一级代理proxy_node1 Nginx配置
[root@lb01 ~]# cd /etc/nginx/conf.d
[root@lb01 conf.d]# cat proxy_ip.xuliangwei.com.conf
server {
listen 80;
server_name ip.xuliangwei.com;
location / {
proxy_pass http://10.0.0.6;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
#2、二级代理proxy_node2 nginx 配置
[root@lb01 conf.d]# cat proxy_ip.xuliangwei.com.conf
server {
listen 80;
server_name ip.xuliangwei.com;
location / {
proxy_pass http://10.0.0.7;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
#3、三级代理proxy_node3 Nginx配置
[root@lb01 conf.d]# cat proxy_ip.xuliangwei.com.conf
server {
listen 80;
server_name ip.xuliangwei.com;
location / {
proxy_pass http://10.0.0.8;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
#4、webserver nginx配置
[root@web02 conf.d]# cat ip.xuliangwei.com.conf
server {
listen 80;
server_name ip.xuliangwei.com;
root /code;
location / {
index index.php index.html;
}
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
测试方式一，通过如下页面获取真实IP，或查看 phpinfo() 函数中的 HTTP_X_FORWARDED_FOR
[root@web02 conf.d]# cat /code/index.php
<?php
$ip = getenv("HTTP_X_FORWARDED_FOR");
echo "X_FORWARDED_FOR: $ip";
?>
测试方式二，通过查看日志测试
#1.proxy_node1代理的日志
10.0.0.1 - - "GET /index.php HTTP/1.1" 200
#2.proxy_node2代理的日志
10.0.0.5 - - "GET /index.php HTTP/1.1" 200 "10.0.0.1"
#3.proxy_node3代理的日志
10.0.0.6 - - "GET /index.php HTTP/1.1" 200 "10.0.0.1, 10.0.0.5"
#4.真实web节点的日志
10.0.0.7 - - "GET /index.php HTTP/1.1" 200 "10.0.0.1, 10.0.0.5, 10.0.0.6"
Nginx RealIP获取真实IP
使用nginx Realip_module获取多级代理下的客户端真实IP地址,在真实Web节点上配置，配置信息如下：
[root@web02 conf.d]# cat ip.xuliangwei.com.conf
server {
listen 80;
server_name ip.xuliangwei.com;
root /code;
set_real_ip_from 10.0.0.5;
set_real_ip_from 10.0.0.6;
set_real_ip_from 10.0.0.7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
#set_real_ip_from：真实服务器上一级代理的IP地址或者IP段,可以写多行
#real_ip_header：从哪个header头检索出需要的IP地址
#real_ip_recursive：递归排除set_real_ip_from里面出现的IP,其余没有出现的认为是用户真实IP
location / {
index index.php index.html;
}
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
最终结果是"10.0.0.1 - - "GET /index.php HTTP/1.1" 200 "10.0.0.5, 10.0.0.6"
10.0.0.5，10.0.0.6都出现在set_real_ip_from中，仅仅10.0.0.1没出现，那么他就被认为是用户的ip地址，同时会被赋值到 $remote_addr变量中。
获取真实IP总结：
forwarded-for：可以获取到用户的真实IP地址。
nginx realip：程序无需改动，直接使用remote_addr变量即可获取真实IP地址，但需要知道所有沿途经过的IP地址或IP段
