Option to have set_real_ip_from use the proxied client ip when using proxy protocol.
|Reported by:||Owned by:|
|uname -a:||Linux ingress-ingress-nginx-controller-5d794cbf68-qck52 5.10.0-0.bpo.9-amd64 #1 SMP Debian 5.10.70-1~bpo10+1 (2021-10-10) x86_64 Linux|
I'm running nginx on kubernetes in the following configuration:
client -> cloudflare -> load balancer -> nginx ingress -> service
My load balancer runs the proxy protocol and sends traffic to nginx which is on a private network. I'd like trust the X-Forwarded-From header from Cloudflare, but I can't configure that because "set_real_ip_from" refers to the IP of the incoming connection to nginx from my load balancer. When I set "set_real_ip_from" to my private network, which the load balancer is on, ngx_http_realip_module trusts the X-Forwarded-From headers sent to it by my load balancer, which could be coming from anywhere, so it's very easily spoofable.
I'd like the option for "set_real_ip_from" to check the IP of the request forwarded to nginx when using the proxy protocol.