由于入访经过负载均衡设备，后端nginx无法获取client_ip,只能通过http_x_forwarded_for获取到最原始用户IP。这里通过http_x_forwarded_for来限制固定IP的用户可以访问。
普通client_ip限制方法
#反向代理地址
upstream sandbox-open {
server 10.10.10.5:8080;
}
#30001对外端口
server {
listen 30001;
server_name sandbox.open.com;
access_log /var/log/nginx/sandbox-open_access.log;
client_max_body_size 20m;
location / {
# 仅允许如下client_ip访问
allow 10.10.10.12;
allow 10.10.11.12/24;
deny all;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://sandbox-open;
proxy_redirect off;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
http_x_forwarded_for限制方法1（推荐）
#http_x_forwarded_for地址不在下列IP中则返回403
map $http_x_forwarded_for $accessip {
default false;
#10.10.10.10(IP匹配)
10.10.10.10 true;
10.10.10.11 true;
10.10.10.12 true;
#10.10.50.0/24(网段匹配)
~*10.10.50. true;
}
#反向代理地址
upstream sandbox-open {
server 10.10.10.5:8080;
}
#30001对外端口
server {
listen 30001;
server_name sandbox.open.com;
access_log /var/log/nginx/sandbox-open_access.log;
client_max_body_size 20m;
location / {
#http_x_forwarded_for地址不在下列IP中则返回403
if ( $accessip = 'false') {return 403;}
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://sandbox-open;
proxy_redirect off;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
http_x_forwarded_for限制方法2
#反向代理地址
upstream sandbox-open {
server 10.10.10.5:8080;
}
#30001对外端口
server {
listen 30001;
server_name sandbox.open.com;
access_log /var/log/nginx/sandbox-open_access.log;
client_max_body_size 20m;
location / {
#http_x_forwarded_for地址不在下列IP中则返回403
set $accessip false;
if ( $http_x_forwarded_for = '10.10.10.10' ) {set $accessip true;}
if ( $http_x_forwarded_for = '10.10.10.11' ) {set $accessip true;}
if ( $http_x_forwarded_for = '10.10.10.12' ) {set $accessip true;}
if ( $http_x_forwarded_for = '192.168.1.1' ) {set $accessip true;}
if ( $accessip = 'false') {return 403;}
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://sandbox-open;
proxy_redirect off;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
此方法测试后发现只能单个IP添加 用如下正则匹配IP段匹配不到
if ( $http_x_forwarded_for = ‘~*10.10.50.’ ) {set $accessip true;}
————————————————
版权声明：本文为CSDN博主「skywin88」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/Skywin88/article/details/117983840