Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/Paxxs/traefik-get-real-ip
traefik get the real IP from the X-Forwarded-For or CDN specified header field.
https://github.com/Paxxs/traefik-get-real-ip
traefik traefik-plugin
Last synced: about 2 months ago
JSON representation
traefik get the real IP from the X-Forwarded-For or CDN specified header field.
- Host: GitHub
- URL: https://github.com/Paxxs/traefik-get-real-ip
- Owner: Paxxs
- Created: 2022-02-21T08:06:51.000Z (over 2 years ago)
- Default Branch: master
- Last Pushed: 2023-07-16T14:14:58.000Z (about 1 year ago)
- Last Synced: 2024-06-20T10:07:02.716Z (3 months ago)
- Topics: traefik, traefik-plugin
- Language: Go
- Homepage:
- Size: 104 KB
- Stars: 56
- Watchers: 2
- Forks: 10
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Traefik Get Real IP address
When traefik is deployed behind multiple load balancers, this plugin can be used to detect different load balancers and extract the real IP from different header fields, then output the value to the `x-real-ip` header.
This plugin can prevent IP spoofing by checking if the values form the received header information of the load balancer match before extracting the IP address.
For example, in the configuration of `CloudFlare` load balancer shown below, we configure it to only accept the header `x-from-cdn` with a value equal to `cf-foo`, and extract the IP address from the `Cf-Connecting-Ip` header. Since users never know about the existence of the `x-from-cdn` header or its required value `cf-foo`, it remains secure 🛡️. To increase complexity and avoid being guessed, you can use a random string :)
```
CloudFlare
┌─────────┐
│ ├────────────────────────────────► ┌───────┬────────┐
└─────────┘ x-from-cdn:cf-foo │ │ │
Cf-Connecting-Ip: realip │ │ │
CDN2 │ │ │
┌─────────┐ │ │ paxxs's│
│ ├────────────────────────────────► │traefik│ │ x-real-ip:realip
└─────────┘ x-from-cdn:mf-bar │ │Get-rea ├─────────────►
Client-iP: realip │ │ l-ip │
CDN3 │ │Plugin │
┌─────────┐ │ │ │
│ ├───────────────────────────────► │ │ │
└─────────┘ x-from-cdn:mf-fun └───────┴────────┘
x-forwarded-for: realip,x.x.x.x
(truthedIP) ▲ ▲
│ │
┌────────┐ │ │
└────────┘ ────────────────────────────────────┘ │
"*" │
┌────────┐ RemoteAddr/etc.. │
└────────┘ ───────────────────────────────────────┘
```
## CDN Configuration
E.g. Cloudflare:
Rules > Transform Rules > HTTP Request Header Modification > Add
- Set static Header: `X-From-Cdn`
- Value: `cf-foo`
## Traefik Configuration
### Static
Plugin Info:
- moduleName: `github.com/Paxxs/traefik-get-real-ip`
- version: `v1.0.2`
Traefik Configuration:
- yml
- toml
- docker-labels
```yml
pilot:
token: [REDACTED]
experimental:
plugins:
real-ip:
moduleName: github.com/Paxxs/traefik-get-real-ip
version: [Please fill the latest version !]
```
### Dynamic
- yml
- toml
- docker labels
- Kubernetes
```yml
http:
middlewares:
real-ip-foo:
plugin:
real-ip:
Proxy:
- proxyHeadername: X-From-Cdn
proxyHeadervalue: mf-fun
realIP: X-Forwarded-For
- proxyHeadername: X-From-Cdn
proxyHeadervalue: mf-bar
realIP: Client-Ip
OverwriteXFF: true # default: false, v1.0.2 or above
- proxyHeadername: X-From-Cdn
proxyHeadervalue: cf-foo
realIP: Cf-Connecting-Ip
OverwriteXFF: true # default: false, v1.0.2 or above
- proxyHeadername: "*"
realIP: RemoteAddr
routers:
my-router:
rule: Host(`localhost`)
middlewares:
- real-ip-foo
service: my-service
services:
my-service:
loadBalancer:
servers:
- url: 'http://127.0.0.1'
```