Linux-frp代理https获取真实源IP

说明

• frp代理https获取真实源IP

• 【架构】:
  • 用户访问域名 ->
  • 请求frps所在外网服务器NGINX ->
  • 外网NGINX监听该域名的80和443端口，并做强制http2https ->
  • 外网NGINX反代到本机frps所监听的HTTPS端口（这是关键） ->
  • 外网frps收到HTTPS请求后代理转发到内网frpc服务器 ->
  • 内网frpc监听了该域名在本地的HTTP和HTTPS代理（即80和443），并且都启用proxy_protocol_version = v2 ->
  • 内网frpc将该域名的HTTPS请求转发到本机NGINX ->
  • 内网NGINX也监听该域名的80和443端口，并且都启用proxy_protocol，没有强制http2https

• 【注意】:
  • 内网、外网NGINX都做了SSL，即配了双份证书，而frpc没有配https2http，只是监听了两个端口而已

关键配置

• frps.ini

vhost_http_port = 1111
vhost_https_port = 2222

• 外网NGINX

server
{
    listen 80;
	listen 443 ssl http2;
    server_name test.test.com;
    index index.php index.html;
    root /www/test.test.com;
    
    #SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
    #error_page 404/404.html;
    ssl_certificate    /fullchain.pem;
    ssl_certificate_key    /privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    error_page 497  https://$host$request_uri;

    #SSL-END
    
    location / 
    {
    	proxy_ssl_server_name on;       #关键点
        proxy_pass https://$host:2222;  #关键点，必须使用$host，2222是frps的HTTPS监听的端口
        proxy_set_header Host $host;    #关键点
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header REMOTE-HOST $remote_addr;
    }
    ...
}

• frpc.ini

[http]
type = http
local_ip = 127.0.0.1
local_port = 80
custom_domains = test.test.com
proxy_protocol_version = v2

[https]
type = https
local_port = 443
custom_domains = test.test.com
proxy_protocol_version = v2
use_encryption = true
use_compression = true

• 内网NGINX

server
{
    listen 80 proxy_protocol;               #关键点
	listen 443 ssl http2 proxy_protocol;    #关键点
    server_name test.test.com;
    index index.php index.html;
    root /www/test.test.com;
    
    #SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
    #error_page 404/404.html;
    ssl_certificate    /fullchain.pem;
    ssl_certificate_key    /privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    error_page 497  https://$host$request_uri;

    #SSL-END
    
    #获取真实IP
    set_real_ip_from 127.0.0.1;         #关键点
    #set_real_ip_from 127.0.0.1/24;     #或者
    real_ip_header X-Forwarded-For;     #关键点
    #real_ip_recursive on;
    ...
}