mirror of
https://github.com/fatedier/frp.git
synced 2026-05-15 16:15:49 -06:00
[GH-ISSUE #4749] frpc的ssh配置怎么样获取客户端真实ip（已解决） #3751
Labels
No labels
In Progress
WIP
WaitingForInfo
bug
doc
duplicate
easy
enhancement
future
help wanted
invalid
lifecycle/stale
need-issue-template
need-usage-help
no plan
proposal
pull-request
question
todo
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/frp#3751
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @gexiaopeng on GitHub (Apr 9, 2025).
Original GitHub issue: https://github.com/fatedier/frp/issues/4749
Bug Description
我在群晖的服务器上配置了frpc的ssh代理，最近有国外ip攻击。群晖获取到的Ip是127.0.0.1，所以无法封锁这个ip。后来在配置里加了transport.proxyProtocolVersion = "v2" ，但ssh无法连接，telnet出错：Invalid SSH identification string。请教 ssh配置怎么样获取到客户端的真实ip? 如果服务端需要nginx代理，那nginx怎么样配置？
frpc Version
0.61.2
frps Version
0.61.2
System Architecture
linux/amd64
Configurations
proxies
name = "ssh"
type = "tcp"
localIP = "127.0.0.1"
localPort = 5005
remotePort = 52223
transport.proxyProtocolVersion = "v2"
Logs
No response
Steps to reproduce
...
Affected area
@ghostLiulang commented on GitHub (Apr 9, 2025):
同问 昨天用HAProxy能成功转发流量到ssh上,但是获取到的请求IP还是127.0.0.1 不是真实IP,最后用的是stcp,两边都上装frp才解决国外IP攻击的问题.
@gexiaopeng commented on GitHub (Apr 9, 2025):
我参考了 https://github.com/fatedier/frp/issues/4692#issuecomment-2728547880 ，可以获取真实ip了，使用
docker比较方便。
@ghostLiulang commented on GitHub (Apr 9, 2025):
我懒得搞了,我的目标是为了安全,稍微麻烦点也问题不大.
@gexiaopeng commented on GitHub (Apr 15, 2025):
我用haproxy也解决了tcp获取真实ip的问题，说明如下：
一、frpc配置：
proxies
name = "ssh"
type = "tcp"
localIP = "127.0.0.1"
localPort = 5005
remotePort = 52223
transport.proxyProtocolVersion = "v2"
二、安装haproxy (3.1 是当前最新稳定分支，可根据需要调整 )
apt install software-properties-common -y &&
add-apt-repository ppa:vbernat/haproxy-3.1 -y &&
apt update &&
apt install haproxy &&
haproxy -v
三、haproxy关键配置：
global
......
setcap cap_net_raw,cap_net_admin
defaults
.....
frontend ssh_proxy
bind *:5005 accept-proxy
mode tcp
timeout client 86400000 # 24小时（可以自己调整）
default_backend ssh_real
backend ssh_real
mode tcp
timeout server 86400000 # 24小时（可以自己调整）
server ssh_local 127.0.0.1:5000 source 0.0.0.0 usesrc clientip
四、haproxy配置注意：
1）global 增加setcap cap_net_raw,cap_net_admin
2）frontend 增加 timeout client 86400000 # 24小时（可以自己调整）
3）backend 增加 timeout server 86400000 # 24小时（可以自己调整）
4）backend的 ssh_local（或者ssh_server） ip地址 必须127.0.0.1（应该是为了安全）
5）backend 的 source 0.0.0.0 usesrc clientip 不能少