On Tue, Mar 12, 2019 at 06:22:30AM -0400, gogan wrote:

Hi there,

> We want to limit requests with limit_req_zone in gninx. Using it directly
> connected to the loadbalancer is fine. It works great, but connections
> coming from myracloud are not limited. Guess nginx is evaluating ip address
> before extracting real client ip from proxy. So, is there a way to solve the
> problem?

My testing suggests that the realip side sets $remote_addr correctly,
and that the geo side uses the correct $remote_addr.

Can you show config / example / logs of the problem that you are reporting?

If you repeat the test below, do you see something different?

==
http {
geo $geo {
default unknown;
127.0.0.1 one;
127.0.0.3 three;
127.0.0.10 ten;
}
server {
listen 8000;
set_real_ip_from 127.0.0.10;
real_ip_header CF-Connecting-IP;

location = /ip {
return 200 "\nCF-Connecting-IP: $http_cf_connecting_ip;\nremote: $remote_addr;\nreal: $realip_remote_addr;\ngeo $geo;\n";
}

}
}
==


# Send the header, and connect from a trusted address; remote and geo
are based on the address from the header:
$ curl -H CF-Connecting-IP:127.0.0.3 http://127.0.0.10:8000/ip

CF-Connecting-IP: 127.0.0.3;
remote: 127.0.0.3;
real: 127.0.0.10;
geo three;


# Send the header, but connect from an untrusted address; remote and
geo are based on the untrusted address:
$ curl -H CF-Connecting-IP:127.0.0.3 http://127.0.0.1:8000/ip

CF-Connecting-IP: 127.0.0.3;
remote: 127.0.0.1;
real: 127.0.0.1;
geo one;

Have I misunderstood what you are doing?

f
--
Francis Daly francis@daoine.org
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx