实战指南：HAProxy 七层与四层源 IP 透传配置详解

web服务器中需要记录客户端的真实IP地址用于做访问统计、安全防护、行为分析、区域排行等场景七层IP透传#实验环境[roothaproxy ~]# vim /etc/haproxy/haproxy.cfglisten webclusterbind*:80 balance roundrobin server haha192.168.0.10:80 check inter 3s fall3rise5weight1server hehe192.168.0.20:80 check inter 3s fall3rise5weight1[roothaproxy ~]# systemctl restart haproxy.service#测试环境[Administrator.DESKTOP-VJ307M3]➤foriin{1..5}docurl172.25.254.100donewebserver1 -192.168.0.10 webserver2 -192.168.0.20 webserver1 -192.168.0.10 webserver2 -192.168.0.20 webserver1 -192.168.0.10#在apache主机中默认是未开启透传功能的/nginx默认开启ip透传[rootwebserver2 ~]# cat /etc/httpd/logs/access_log192.168.0.100 - -[26/Jan/2026:10:03:03 0800]GET / HTTP/1.120026-curl/7.65.0192.168.0.100 - -[26/Jan/2026:10:03:03 0800]GET / HTTP/1.120026-curl/7.65.0#开启ip透传的方式[roothaproxy ~]# vim /etc/haproxy/haproxy.cfg。。。忽略。。。。。 defaults mode http log global option httplog option dontlognull option http-server-close option forwardfor except127.0.0.0/8#开启haproxy透传功能option redispatch retries3timeouthttp-request 10stimeoutqueue 1mtimeoutconnect 10stimeoutclient 1mtimeoutserver 1mtimeouthttp-keep-alive 10stimeoutcheck 10s maxconn3000#在Apache中设定采集透传IP[rootwebserver2 ~]# vim /etc/httpd/conf/httpd.conf201LogFormat%h %l %u %t\%r\%s %b\%{X-Forwarded-For}i\\%{Referer}i\\%{User-Agent}i\combined[rootwebserver2 ~]# systemctl restart httpd#测试效果[rootwebserver2 ~]# cat /etc/httpd/logs/access_log192.168.0.100 - -[26/Jan/2026:10:10:29 0800]GET / HTTP/1.120026172.25.254.1-curl/7.65.0192.168.0.100 - -[26/Jan/2026:10:10:30 0800]GET / HTTP/1.120026172.25.254.1-curl/7.65.0192.168.0.100 - -[26/Jan/2026:10:10:30 0800]GET / HTTP/1.120026172.25.254.1-curl/7.65.0四层IP透传#环境设置#RS1中部署apache[rootwebserver1 ~]# dnf install httpd -y[rootwebserver1 ~]# echo RS2 - 192.168.0.10 /var/www/html/index.html[rootwebserver1 ~]# systemctl enable --now httpd#在RS2中部署nginx#部署nginx[rootwebserver2 ~]# dnf install nginx -y[rootwebserver2 ~]# echo RS2 - 192.168.0.20 /usr/share/nginx/html/index.html[rootwebserver2 ~]# systemctl enable --now nginx#测环境[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10#启用apache的四层访问控制[rootnode1 ~]# vim /etc/httpd/conf.modules.d/10-proxy_h2.confLoadModule proxy_http2_module modules/mod_proxy_http2.so LoadModule remoteip_module modules/mod_remoteip.so[rootnode1 ~]# vim /etc/httpd/conf/httpd.confRemoteIPProxyProtocol on RemoteIPTrustedProxy192.168.0.0/24#直接添加[rootnode1 ~]# systemctl restart httpd#启用nginx的四层访问控制[rootwebserver2 ~]# vim /etc/nginx/nginx.confserver{listen80proxy_protocol;#启用四层访问控制listen[::]:80;server_name _;root /usr/share/nginx/html;# Load configuration files for the default server block.include /etc/nginx/default.d/*.conf;error_page404/404.html;location/404.html{}[rootwebserver2 ~]# systemctl restart nginx.service#测试Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;donehtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/htmlhtmlbodyh1502Bad Gateway/h1The server returned an invalid or incomplete response./body/html出现上述报错标识nginx只支持四层访问#设定haproxy访问4层[roothaproxy ~]# vim /etc/haproxy/haproxy.cfglisten webclusterbind*:80 mode tcp#四层访问balance roundrobin server haha192.168.0.10:80 send-proxy check inter 3s fall3rise5weight1server hehe192.168.0.20:80 send-proxy check inter 3s fall3rise5weight1#添加send-proxy[roothaproxy ~]# systemctl restart haproxy.service#测试四层访问[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10#设置4层ip透传[rootwebserver12~]# vim /etc/nginx/nginx.conflog_format main$remote_addr - $remote_user [$time_local] $request $proxy_protocol_addr#采集透传信息$status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;[rootwebserver12~]# systemctl restart nginx.service#测试[Administrator.DESKTOP-VJ307M3]➤foriin{1..5};docurl172.25.254.100;doneRS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20 RS1 -192.168.0.10 RS2 -192.168.0.20[rootwebserver1 ~]# cat /var/log/nginx/access.log192.168.0.100 - -[26/Jan/2026:10:52:40 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-192.168.0.100 - -[26/Jan/2026:10:53:49 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-192.168.0.100 - -[26/Jan/2026:10:53:50 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-192.168.0.100 - -[26/Jan/2026:10:53:50 0800]GET / HTTP/1.1172.25.254.120019-curl/7.65.0-​