Server Load Balancer:Obtain client IP addresses through an NLB instance

Client IP preservation

Prerequisites

• You have created an NLB server group and added backend servers to it. This topic uses an ECS-type server group as an example. The backend protocol is TCP, ECS instances are used as backend servers, and the application on the backend servers uses port 80. For more information, see NLB server groups.

• You have created an NLB instance and added a listener to it. This topic uses a TCP listener on port 80 as an example. For more information, see Create and manage NLB instances and Add a TCP listener.

Step 1: Check client IP preservation

1. Log on to the Network Load Balancer console.

2. In the top navigation bar, select the region where the instance is deployed.

3. On the Server Groups page, find the target server group and click its ID.

4. On the server group details page, verify that the Client IP Preservation field is set to Enabled. If it is Disabled, click Modify Basic Information and enable the feature.

Step 2: Verify client IP retrieval

If NGINX is used as a backend server, you can check the NGINX logs to verify that the client IP address is obtained.

The following example shows the default log field configuration in NGINX:

http {
  # Default configuration
  log_format  main  '$remote_addr- $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
	#...
}

The default path for the NGINX log file is /var/log/nginx/access.log.

The first IP address in each log entry is the client IP address.

140.205.1xxx -- [xxx] xxx xxx xxx xxx xxx xxx
xxx xxx xxx xxx xxx xxx xxx xxx xxx xxx
140.205.xx.29 -- [27/xxx] xxx xxx xxx xxx xxx xxx 527 xxx
xxx xxx xxx xxx xxx xxx xxx xxx xxx
140.205.xx.29 -- [2xxx] xxx xxx 304 xxx xxx xxx xxx xxx

Proxy Protocol

Prerequisites

• You have created an NLB server group and added backend servers to it. This topic uses an ECS-type server group as an example. The backend protocol is TCP, ECS instances are used as backend servers, and the application on the backend servers uses port 80. For more information, see NLB server groups.

• You have created an NLB instance and added a listener to it. This topic uses a TCP listener on port 80 as an example. For more information, see Create and manage NLB instances.

  Note

  • Before you enable Proxy Protocol, make sure your backend servers support Proxy Protocol v2. Otherwise, new connections will fail.

  • If multiple listeners of an instance are associated with the same server group, you must enable Proxy Protocol for all of them.

  • NGINX Plus R16 or later and open source NGINX 1.13.11 or later support Proxy Protocol v2.

Step 1: Enable Proxy Protocol on the listener

1. Log on to the Network Load Balancer console.

2. In the top navigation bar, select the region where the instance is deployed.

3. On the Instances page, find the target instance and click its ID.

4. On the Instance Details page, click the Listener tab, find the target listener, and click the listener ID.

5. On the Listener Details page, verify that the Enable Proxy Protocol field is set to Enabled. If it is not enabled, click Modify Listener and enable the feature.

Step 2: Enable Proxy Protocol on the backend server

This section uses CentOS 7.9 and NGINX 1.20.1 as an example. Your configuration may vary.

1. Log on to the backend server and run the nginx -t command to find the path of the configuration file. The default path is typically /etc/nginx/nginx.conf, but the actual path may vary.

2. Modify and save the configuration file to enable Proxy Protocol, as shown in the following example.

   http {
     # Make sure to set $proxy_protocol_addr. This variable is used to record the client IP address.
     log_format  main  '$proxy_protocol_addr - $remote_addr- $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for"';
     # For a listener on port 80, add the proxy_protocol parameter.
     server {
       listen 80   proxy_protocol;
       #...
     }
   }
               

3. Run the sudo nginx -s reload command to reload the NGINX configuration file.

Step 3: Verify client IP retrieval

If NGINX is used as a backend server, you can check the NGINX logs to verify that the client IP address is obtained.

The default path for the NGINX log file is /var/log/nginx/access.log.

In each log entry, the IP address for the $proxy_protocol_addr variable is the client IP address.

140.205.1xxx -- [xxx]
xxx
140.205.xx.29 -- [27/xxx] xxx xxx xxx
xxx
140.205.xx.29 -- [2xxx] 304 xxx xxx xxx
xxx

Proxy Protocol v2 header reference

If you do not use NGINX, refer to the Proxy Protocol v2 header structure below and The PROXY protocol to implement custom parsing. See your server's official documentation for details.

• The following figure shows the binary header format for Proxy Protocol v2 when carrying an IPv4 client address:

• The following figure shows the binary header format for Proxy Protocol v2 when carrying an IPv6 client address: