实战指南：HAProxy 七层与四层源 IP 透传配置详解-北京尧图网络

web服务器中需要记录客户端的真实IP地址用于做访问统计、安全防护、行为分析、区域排行等场景七层IP透传#实验环境[roothaproxy ~]# vim /etc/haproxy/haproxy.cfglisten webclusterbind*:80 balance roundrobin server haha192.168.0.10:80 check inter 3s fall3rise5weight1server hehe192.168.0.20:80 check inter 3s fall3rise5weight1[roothaproxy ~]# systemctl restart haproxy.service#测试环境[Administrator.DESKTOP-VJ307M3]➤foriin{1..5}docurl172.25.254.100donewebserver1 -192.168.0.10 webserver2 -192.168.0.20 webserver1 -192.168.0.10 webserver2 -192.168.0.20 webserver1 -192.168.0.10#在apache主机中默认是未开启透传功能的/nginx默认开启ip透传[rootwebserver2 ~]# cat /etc/httpd/logs/access_log192.168.0.100 - -[26/Jan/2026:10:03:03 0800]GET / HTTP/1.120026-curl/7.65.0192.168.0.100 - -[26/Jan/2026:10:03:03 0800]GET / HTTP/1.120026-curl/7.65.0#开启ip透传的方式[roothaproxy ~]# vim /etc/haproxy/haproxy.cfg。。。忽略。。。。。 defaults mode http log global option httplog option dontlognull option http-server-close option forwardfor except127.0.0.0/8#开启haproxy透传功能option redispatch retries3timeouthttp-request 10stimeoutqueue 1mtimeoutconnect 10stimeoutclient 1mtimeoutserver 1mtimeouthttp-keep-alive 10stimeoutcheck 10s maxconn3000#在Apache中设定采集透传IP[rootwebserver2 ~]# vim /etc/httpd/conf/httpd.conf201LogFormat%h %l %u %t\%r\%s %b\%{X-Forwarded-For}i\\%{Referer}i\\%{User-Agent}i\combined[rootwebserver2 ~]# systemctl restart httpd#测试效果[rootwebserver2 ~]# cat /etc/httpd/logs/access_log192.168.0.100 - -[26/Jan/2026:10:10:29 0800]GET / HTTP/1.120026172.25.254.1-curl/7.65.0192.168.0.100 - -[26/Jan/2026:10:10:30 0800]GET / HTTP/1.120026172.25.254.1-curl/7.65.0192.168.0.100 - -[26/Jan/2026:10:10:30 0800]GET / HTTP/1.120026172.25.254.1-curl/7.65.0四层IP透传#环境设置#RS1中部署apache[rootwebserver1 ~]# dnf install httpd -y[rootwebserver1 ~]# echo RS2 - 192.168.0.10 /var/www/html/index.html[rootwebserver1 ~]# systemctl enable --now httpd#在RS2中部署nginx#部署nginx[rootwebserver2 ~]# dnf install nginx -y[rootwebserver2 ~]# echo RS2 - 192.168.0.20 /usr/share/nginx/html/index.html[rootwebserver2 ~]# systemctl enable --now nginx#测环境[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10#启用apache的四层访问控制[rootnode1 ~]# vim /etc/httpd/conf.modules.d/10-proxy_h2.confLoadModule proxy_http2_module modules/mod_proxy_http2.so LoadModule remoteip_module modules/mod_remoteip.so[rootnode1 ~]# vim /etc/httpd/conf/httpd.confRemoteIPProxyProtocol on RemoteIPTrustedProxy192.168.0.0/24#直接添加[rootnode1 ~]# systemctl restart httpd#启用nginx的四层访问控制[rootwebserver2 ~]# vim /etc/nginx/nginx.confserver{listen80proxy_protocol;#启用四层访问控制listen[::]:80;server_name _;root /usr/share/nginx/html;# Load configuration files for the default server block.include /etc/nginx/default.d/*.conf;error_page404/404.html;location/404.html{}[rootwebserver2 ~]# systemctl restart nginx.service#测试Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;donehtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/html出现上述报错标识nginx只支持四层访问#设定haproxy访问4层[roothaproxy ~]# vim /etc/haproxy/haproxy.cfglisten webclusterbind*:80 mode tcp#四层访问balance roundrobin server haha192.168.0.10:80 send-proxy check inter 3s fall3rise5weight1server hehe192.168.0.20:80 send-proxy check inter 3s fall3rise5weight1#添加send-proxy[roothaproxy ~]# systemctl restart haproxy.service#测试四层访问[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10#设置4层ip透传[rootwebserver12~]# vim /etc/nginx/nginx.conflog_format main$remote_addr - $remote_user [$time_local] $request $proxy_protocol_addr#采集透传信息$status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;[rootwebserver12~]# systemctl restart nginx.service#测试[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20[rootwebserver1 ~]# cat /var/log/nginx/access.log192.168.0.100 - -[26/Jan/2026:10:52:40 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-192.168.0.100 - -[26/Jan/2026:10:53:49 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-192.168.0.100 - -[26/Jan/2026:10:53:50 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-192.168.0.100 - -[26/Jan/2026:10:53:50 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-

实战指南：HAProxy 七层与四层源 IP 透传配置详解

相关推荐

电路增益全解析：从电压、电流、功率到设计实战

NV-Q-Link 相关的代码信息收集

从B站视频到个人音乐库：BilibiliDown音频提取完全指南

更多资讯

国内可以做的国外兼职网站进阶技巧

网站被黑挂马?3步图解步骤搞定软件介绍下载网站建设安全

新手从零搭建网站促销活动策划避坑指南：3个方案费用全拆解

深圳技术支持骏域网站建设：3种方案报价拆解，告别网站没人看

3招搞定wordpress多程序用户同步，一文搞懂省钱逻辑

Java IEC 62056-21 C模式主站协议库：从串口到TCP的能源数据采集实践

今日更新

济南做网站多少钱：3个案例拆解，防黑源码下载全攻略

婚恋网站实战案例：避开3个高价坑，省钱50%还能跑赢流量

制作网页比较方便的软件怎么选?一文搞懂避坑指南

本周精选

如何彻底离线使用 Laya-CoreML：Hugging Face 下载、缓存机制与 local_files_only 详解

基于1Panel 部署MySQL MCP 服务：TaoToken 统一 Key 接入与 config.toml 配置实战

崇州园区营销网站建设避坑指南：5大注意事项保备案安全

本月热门

基于YOLO的焊缝缺陷检测：从数据标注到工业部署全流程实践

分布式服务的决策记录

创业产品的首版范围

读完文章，想聊聊您的网站？