I have such setup of K8S:
Cloudflare -> Digital Ocean Load Balancer -> Nginx Ingress -> Nginx Container
Based on my answer on this question all works fine up to Nginx Ingress here I get the correct IP of the user.
But inside Nginx Contaier the IP is set to the service IP.
I restored it by using:
set_real_ip_from 0.0.0.0/0;
real_ip_header X-Forwarded-For;
But I don't trust this line: set_real_ip_from 0.0.0.0/0; becuase is from any IP, I can't get CIDR of ingress service.
My question is there is a better way to restore client IP inside nginx container when request are coming from Ingress Service?
CodePudding user response：
If you can read the headers forwarded by Cloudflare, a proxied request will include the CF-Connecting-IP header which will contain the IP of the client that connected to Cloudflare in first place.
(docs)
CodePudding user response：
There is no better way to restore the client IP.
However, you should only allow cloudflares IP address ranges with set_real_ip_from as described here (note that the german version of this example is much better than the english):
set_real_ip_from 103.21.244.0/22;set_real_ip_from 103.22.200.0/22;set_real_ip_from 103.31.4.0/22;set_real_ip_from 104.16.0.0/12;set_real_ip_from 108.162.192.0/18;set_real_ip_from 131.0.72.0/22;set_real_ip_from 141.101.64.0/18;set_real_ip_from 162.158.0.0/15;set_real_ip_from 172.64.0.0/13;set_real_ip_from 173.245.48.0/20;set_real_ip_from 188.114.96.0/20;set_real_ip_from 190.93.240.0/20;set_real_ip_from 197.234.240.0/22;set_real_ip_from 198.41.128.0/17;set_real_ip_from 2400:cb00::/32;set_real_ip_from 2606:4700::/32;set_real_ip_from 2803:f800::/32;set_real_ip_from 2405:b500::/32;set_real_ip_from 2405:8100::/32;set_real_ip_from 2c0f:f248::/32;set_real_ip_from 2a06:98c0::/29;
The list of ip address ranges may change from time to time. It can be found here: https://www.cloudflare.com/ips/