小开发咨询下运维的问题,nginx 转发到 kong 网关， ip-restriction 插件失效问题

请求流程如下

用户请求 -> nginx -> kong 网关

需求如下 想通过 kong 网关 ip-restriction 插件 限制部分用户的真实 ip 访问接口

遇到的问题

1 、kong 网关这边获取到的 X-real-ip 一直都是 nginx 节点的 ip ，导致 ip-restriction 插件失效

nginx 部分配置

 location / {
            proxy_pass        http://a.kong.com/;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
}

kong 网关配置

server {
   server_name kong;
   listen 0.0.0.0:8000;
   error_page 400 404 408 411 412 413 414 417 494 /kong_error_handler;
   error_page 500 502 503 504 /kong_error_handler;

   access_log logs/access.log main;
   error_log logs/error.log notice;

   client_body_buffer_size 8k;


   real_ip_header     X-Real-IP;
   real_ip_recursive  off;
   set_real_ip_from 0.0.0.0/0;
   set_real_ip_from ::/0;


   include nginx-x-header.conf;

   location / {
       default_type                     '';

       set $ctx_ref                     '';
       set $upstream_host               '';
       set $upstream_upgrade            '';
       set $upstream_connection         '';
       set $upstream_scheme             '';
       set $upstream_uri                '';
       set $upstream_x_forwarded_for    '';
       set $upstream_x_forwarded_proto  '';
       set $upstream_x_forwarded_host   '';
       set $upstream_x_forwarded_port   '';

       rewrite_by_lua_block {
           Kong.rewrite()
       }

       access_by_lua_block {
           Kong.access()
       }

       proxy_http_version 1.1;
       proxy_set_header   Host              $upstream_host;
       proxy_set_header   Upgrade           $upstream_upgrade;
       proxy_set_header   Connection        $upstream_connection;
       proxy_set_header   X-Forwarded-For   $upstream_x_forwarded_for;
       proxy_set_header   X-Forwarded-Proto $upstream_x_forwarded_proto;
       proxy_set_header   X-Forwarded-Host  $upstream_x_forwarded_host;
       proxy_set_header   X-Forwarded-Port  $upstream_x_forwarded_port;
       proxy_set_header   X-Real-IP         $remote_addr;
       proxy_pass_header  Server;
       proxy_pass_header  Date;
       proxy_ssl_name     $upstream_host;
       proxy_pass         $upstream_scheme://kong_upstream$upstream_uri;

       header_filter_by_lua_block {
           Kong.header_filter()
       }

       body_filter_by_lua_block {
           Kong.body_filter()
       }

       log_by_lua_block {
           Kong.log()
       }
   }

   location = /kong_error_handler {
       internal;
       uninitialized_variable_warn off;

       content_by_lua_block {
           Kong.handle_error()
       }

       header_filter_by_lua_block {
           Kong.header_filter()
       }

       body_filter_by_lua_block {
           Kong.body_filter()
       }

       log_by_lua_block {
           Kong.log()
       }
   }
}

将 nginx 的 IP 添加到 kong 的 trusted_ips 中就可以获取到了 可以参考 kong gateway 的配置 https://docs.konghq.com/gateway/latest/reference/configuration/#trusted_ips

@swq1227 感谢回复，我在 kong 的配置中加了 set_real_ip_from 0.0.0.0/0; set_real_ip_from ::/0; 甚至在 kong.conf 中 加了 trusted_ips = 0.0.0.0/0,::/0 没效果 我配置后 重新执行 /usr/local/openresty/nginx/sbin/nginx -p /data/servers/kong -c nginx.conf 貌似没生效

我觉得这个问题问 Claude ，你可以很快解决。

@5261 是直接指定 Nginx 的内网地址

开 ssh ，让我上去看看