Server Load Balancer:Obtaining client IP addresses through a CLB Layer 4 listener

Direct retrieval

In this scenario, you can obtain the client IP address directly from the backend server.

If you use Nginx as the backend server, you can check the Nginx logs to verify that the client's IP address was captured correctly.

The following example shows the default log field configuration for Nginx:

http {
  # Default configuration
  log_format  main  '$remote_addr- $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
	#...
}

The default path for the Nginx log file is /var/log/nginx/access.log.

The first IP address in each log entry is the client's real IP address.

140.205.1xxx - - [xxx, xxx] xxx xxx xxx xxx xxx xxx
xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx
140.205.xx.29 - [27/xxx xxx] xxx xxx xxx xxx xxx xxx xxx
xxx xxx xxx xxx xxx xxx xxx xxx xxx
140.205.xx.29 - - [2xxx xxx] 304 xxx xxx xxx xxx xxx xxx

Proxy Protocol

Prerequisites

• You have created a CLB instance and added a listener to it. This topic uses a TCP listener on port 80 as an example. For more information, see Create and manage CLB instances and Add a TCP listener.

• You have created an available server group for the CLB instance and added backend servers to it. This topic uses a vServer group with TCP as the backend protocol and ECS instances that listen on port 80 as backend servers. For more information, see Create and manage a vServer group.

  Note

  • Before you enable Proxy Protocol, make sure your backend servers support Proxy Protocol v2. Otherwise, new connections may fail.

  • Nginx Plus R16 or later and open-source Nginx 1.13.11 or later support Proxy Protocol v2.

  • If multiple listeners of a CLB instance are associated with the same group of backend servers, you must enable Proxy Protocol for all of these listeners.

Step 1: Enable Proxy Protocol for the listener

1. Log on to the Classic Load Balancer (CLB) console.

2. In the top navigation bar, select the region where the CLB instance is deployed.

3. On the Instances page, find the target instance and click its ID.

4. On the instance details page, click the Listener tab, find the target Layer 4 listener and click its ID.

5. On the listener details page, check if the Proxy Protocol parameter is set to Use the Proxy protocol to pass client IP addresses to backend servers.. If this parameter is not displayed, click Modify Listener and enable the feature on the configuration page.

   Important

   This feature does not support seamless migration. Enabling Proxy Protocol requires a service restart to apply the changes. Proceed with caution.

Step 2: Enable Proxy Protocol on the backend

This section uses a server with CentOS 7.9 and Nginx 1.20.1 as an example. The configurations may vary based on your environment.

1. Log on to a backend server and run the nginx -t command to find the path of the configuration file. The default path is typically /etc/nginx/nginx.conf. The actual path may vary.

2. Modify the Proxy Protocol settings in the configuration file and save the changes. Refer to the following example for the modifications:

   http {
     # Make sure to set $proxy_protocol_addr.
     log_format  main  '$proxy_protocol_addr - $remote_addr- $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for"';
     # Use port 80 as an example and add the proxy_protocol parameter.
     server {
       listen 80   proxy_protocol;
       #...
     }
   }
               

3. Run the sudo nginx -s reload command to reload the Nginx configuration file.

Step 3: Verify the result

If Nginx is used as the backend server, you can check the Nginx logs to verify whether the client's real IP address is successfully obtained.

The default path for the Nginx log file is /var/log/nginx/access.log.

In each log entry, the IP address corresponding to the $proxy_protocol_addr variable is the client's real IP address.

Proxy Protocol v2 header formats

If you do not use the server in the preceding example, you can refer to the Proxy Protocol v2 header formats and The PROXY protocol to implement custom parsing. For details, see the official documentation for your server.

• The following figure shows the binary header format for Proxy Protocol v2 that carries a client IPv4 address:

• The following figure shows the binary header format for Proxy Protocol v2 that carries a client IPv6 address: