Server Load Balancer:Enable NLB to preserve client IP addresses

Enable the client IP preservation feature

Prerequisites

• An NLB server group is created, and backend servers are added to the server group. In this example, a server group of the server type is created. The backend protocol is TCP, Elastic Compute Service (ECS) instances are used as backend servers, and port 80 is used by the backend applications. For more information, see Create and manage a server group.

• An NLB instance is created, and a listener is created for the NLB instance. A TCP listener that uses port 80 is used in this example. For more information, see Create and manage an NLB instance and Add a TCP listener.

Step 1: Check whether the server group has client IP preservation enabled

1. Log on to the NLB console.

2. In the top navigation bar, select the region in which the NLB instance is deployed.

3. On the Server Groups page, click the ID of the server group that you want to manage.

4. On the details page of the server group, check whether the status of Client IP Preservation is Enabled. If the status is Disabled, click Modify Basic Information to enable the feature.

Step 2: Check whether the backend servers can preserve client IP addresses

If NGINX applications are deployed on the backend servers, you can check the NGINX log to determine whether the backend servers can preserve client IP addresses.

The following code block shows the default configurations of fields in the NGINX log.

http {
  # Default configurations
  log_format  main  '$remote_addr- $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
	#...
}

The default path of the NGINX log is /var/log/nginx/access.log.

The first IP address in each log entry is a client IP address.

Enable the Proxy protocol

Prerequisites

• An NLB server group is created, and backend servers are added to the server group. In this example, a server group of the server type is created. The backend protocol is TCP, ECS instances are used as backend servers, and port 80 is used by the backend applications. For more information, see Create and manage a server group.

• An NLB instance is created, and a listener is created for the NLB instance. A TCP listener that uses port 80 is used in this example. For more information, see Create and manage an NLB instance.

  Note

  • Before you enable the Proxy protocol, make sure that your backend servers support Proxy protocol v2.

  • If multiple listeners are associated with the same backend server group, the Proxy protocol must be enabled on all the listeners.

  • NGINX Plus R16 and later versions and open source NGINX 1.13.11 and later versions support Proxy protocol v2.

Step 1: Enable the Proxy protocol for listeners

1. Log on to the NLB console.

2. In the top navigation bar, select the region in which the NLB instance is deployed.

3. On the Instances page, click the ID of the instance that you want to manage.

4. On the instance details page, click the Listener tab, and click the ID of the listener that you want to manage.

5. On the listener details page, check whether the status of Enable Proxy Protocol is Enabled. If the Proxy protocol is disabled, click Modify Listener to enable the Proxy protocol.

Step 2: Enable the Proxy protocol for backend servers

In this example, the CentOS 7.9 operating system and NGINX 1.20.1 are used. Adjust the configurations based on the environment that you use.

1. Log on to the backend server and run the nginx -t command to query the path of the configuration file. The default path is /etc/nginx/nginx.conf, which may vary based on the environment that you use.

2. Modify the configurations of the Proxy protocol and save the modifications. The following code block shows an example.

   http {
     # Set the variable $proxy_protocol_addr, which is used to record client IP addresses.
     log_format  main  '$proxy_protocol_addr - $remote_addr- $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for"';
     # Specify that the listener uses port 80, and add the proxy_protocol.
     server {
       listen 80   proxy_protocol;
       #...
     }
   }
   

3. Run the sudo nginx -s reload command to reload the NGINX configuration file.

Step 3: Test whether the backend servers can preserve client IP addresses

If NGINX applications are deployed on the backend servers, you can check the NGINX log to determine whether the backend servers can preserve client IP addresses.

The default path of the NGINX log is /var/log/nginx/access.log.

In each log entry, the IP address in the variable $proxy_protocol_addr is a client IP address.

Sample packets transmitted over Proxy protocol v2

The backend servers that you use are different from those in the preceding examples, you can refer to the manual of your server provider and The PROXY protocol to customize parsing configurations based on the packet structure defined by Proxy protocol v2.

• The following example shows how an IPv4 client IP address is preserved in the Proxy protocol v2 header in the binary format.

• The following example shows how an IPv6 client IP address is preserved in the Proxy protocol v2 header in the binary format.