How to Obtain the Real IP Address After Using Alibaba Cloud SLB (How to Obtain the Real IP After Using Load Balancing Solutions Such as LVS)
After using Layer 7 load balancing, all access to the final real server is initiated by the proxy. Therefore, the access IP recorded in the logs is that of the proxy. In this case, if you want to obtain the real IP address, Alibaba Cloud Official provides methods to use http_realip_module or mod_rpaf to obtain the real IP(This method not only allows recording the IP in the logs but also prohibits specific IPs from accessing the site). However, this approach has a drawback: you need to manually write all the proxy request IPs into the configuration file. Moreover, if the SLB server cluster is scaled up and you are unaware of it, unfortunately, requests initiated by the newly added servers will be recorded in your logs with their server IPs instead of the visitors’ IPs~~
In fact, it doesn’t have to be that complicated. The SLB server records the customer’s real IP in the X_FORWARDED_FOR field of the HTTP header.
Both Apache and Nginx can directly read any field value from the HTTP header. Therefore, you can configure the X_FORWARDED_FOR field in the logformat. The test results are as follows:
Apache:
Log Format Configuration
1 |
LogFormat "'realip:'%{X-Forwarded-For}i 'slbip:'%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined |
After restarting Apache, testing shows that the real IP can be obtained, as shown below:
Records where realip is still ‘-‘ are health check records from the SLB server, not customer access records, and can be ignored.
Nginx
The log configuration is as follows:
1 |
log_format main 'realip:$http_x_forwarded_for slbip:$remote_addr - $remote_user [$time_local] "$request" ' |
2 |
'$status $body_bytes_sent "$http_referer" ' |
3 |
'"$http_user_agent"'; |
After testing, the real IP can be obtained, as shown below:
As mentioned above, records where realip was not obtained are health check records, not customer access records, and can be ignored.
This method is not provided by Alibaba Cloud officially. I tested it on several of my own servers without any issues. In short, if this method meets your needs after testing, you can try it~~