Server Load Balancer:Enable Layer 4 listeners to preserve client IP addresses

Directly obtain client IP addresses

In this scenario, backend servers can directly obtain client IP addresses.

If NGINX applications are deployed on the backend servers, you can check the NGINX log to determine whether the backend servers can obtain client IP addresses.

The following code block shows the default configurations of fields in the NGINX log.

http {
  # Default configurations
  log_format  main  '$remote_addr- $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
	#...
}

The default path of the NGINX log is /var/log/nginx/access.log.

The first IP address in each log entry is a client IP address.

Enable the Proxy protocol

Prerequisites

• A CLB instance is created and listeners are created. In this example, a TCP listener that listens on port 80 is created. For more information, see Create and manage a CLB instance and Add a TCP listener.

• A server group is created for the CLB instance and backend servers are added to the server group. In this example, a vServer group that uses TCP as the backend protocol is created. Elastic Compute Service (ECS) instances that use port 80 to receive requests are added to the vServer group. For more information, see Create and manage a vServer group.

  Note

  • Before you enable the Proxy protocol, make sure that your backend servers support Proxy protocol v2.

  • NGINX Plus R16 and later versions and open source NGINX 1.13.11 and later versions support Proxy protocol v2.

  • If the backend servers in a backend server group are attached to multiple listeners of a CLB instance, you must enable the Proxy protocol for all these listeners.

Step 1: Enable the Proxy protocol for the listener

1. Log on to the CLB console.

2. In the top navigation bar, select the region in which the CLB instance is deployed.

3. On the Instances page, click the ID of the CLB instance that you want to manage.

4. On the instance details page, click the Listeners tab, find the Layer 4 listener, and then click its ID.

5. On the listener details page, the Proxy Protocol parameter is set to Use the Proxy protocol to pass client IP addresses to backend servers. If the parameter is not displayed, click Modify Listener to enable the Proxy protocol.

   Important

   This feature does not support seamless migration. To enable the Proxy protocol, CLB needs to suspend and update your businesses. Proceed with caution.

Step 2: Enable the Proxy protocol on backend servers

In this example, the CentOS 7.9 operating system and NGINX 1.20.1 are used. Adjust the configurations based on the environment that you use.

1. Log on to a backend server and run the nginx -t command to query the path of the configuration file. The default path is /etc/nginx/nginx.conf, which may vary based on the environment that you use.

2. Modify the configurations of the Proxy protocol and save the modifications. The following code block shows an example:

   http {
     # Make sure that $proxy_protocol_addr is configured.
     log_format  main  '$proxy_protocol_addr - $remote_addr- $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for"';
     # Specify port 80 as the listener port and add the proxy_protocol.
     server {
       listen 80   proxy_protocol;
       #...
     }
   }
   

3. Run the sudo nginx -s reload command to reload the NGINX configuration file.

Step 3: Verify that the backend servers can obtain client IP addresses

If NGINX applications are deployed on the backend servers, you can check the NGINX log to determine whether the backend servers can obtain client IP addresses.

The default path of the NGINX log is /var/log/nginx/access.log.

In each log entry, the IP address in the $proxy_protocol_addr variable is a client IP address.

Proxy protocol v2 header formats

If the backend servers that you use are different from those in the preceding examples, you can refer to the manual of your server provider and The PROXY protocol to customize parsing configurations based on the header formats defined by Proxy protocol v2.

• The following example shows how an IPv4 client IP address is preserved in the Proxy Protocol v2 header in the binary format.

• The following example shows how an IPv6 client IP address is preserved in the Proxy Protocol v2 header in the binary format.