github-starred/frp

Fork 0

mirror of https://github.com/fatedier/frp.git synced 2026-05-15 08:05:49 -06:00

[GH-ISSUE #1164] get real user's ip in https environment by using proxy protocol #910

New issue

Closed

opened 2026-05-05 12:34:44 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 12:34:44 -06:00

Owner

Originally created by @dreamren on GitHub (Mar 27, 2019).
Original GitHub issue: https://github.com/fatedier/frp/issues/1164

Because I only have an HTTPS service in an Intranet environment, I want to get the user's real IP when the FRP-side inexistence webserver. FRP can support that by proxy protocol. Nginx has long provided proxy protocol support. Note that in this case the Intranet webserver does not provide the standard HTTPS service, but the FRP server can provide the standard HTTPS service.

Thanks.

Originally created by @dreamren on GitHub (Mar 27, 2019). Original GitHub issue: https://github.com/fatedier/frp/issues/1164 Because I only have an HTTPS service in an Intranet environment, I want to get the user's real IP when the FRP-side inexistence webserver. FRP can support that by proxy protocol. Nginx has long provided proxy protocol support. Note that in this case the Intranet webserver does not provide the standard HTTPS service, but the FRP server can provide the standard HTTPS service. Thanks.

gitea-mirror

2026-05-05 12:34:44 -06:00

closed this issue
added the
todo
label

gitea-mirror commented

2026-05-05 12:34:47 -06:00

Author

Owner

@fatedier commented on GitHub (Mar 27, 2019):

Your https service in the Intranet support proxy protocol ?

I think it's not widely used, but it's ok to support it with a low priority.

@fatedier commented on GitHub (Mar 27, 2019): Your https service in the Intranet support proxy protocol ? I think it's not widely used, but it's ok to support it with a low priority.

gitea-mirror commented

2026-05-05 12:34:47 -06:00

Author

Owner

@dreamren commented on GitHub (Mar 27, 2019):

Your https service in the Intranet support proxy protocol ?

I think it's not widely used, but it's ok to support it with a low priority.

Yes. I use these config in my Intranet nginx server:
http{
server{
listen unix:/dev/shm/localweb.sock ssl http2 proxy_protocol;
port_in_redirect off;
set_real_ip_from unix:;
real_ip_header proxy_protocol;
real_ip_recursive on;
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Fowarded-For $proxy_protocol_addr;
#...
}
}

It's really not widely used, thanks for the support plan!

@dreamren commented on GitHub (Mar 27, 2019): > Your https service in the Intranet support proxy protocol ? > > I think it's not widely used, but it's ok to support it with a low priority. Yes. I use these config in my Intranet nginx server: http{ server{ listen unix:/dev/shm/localweb.sock ssl http2 proxy_protocol; port_in_redirect off; set_real_ip_from unix:; real_ip_header proxy_protocol; real_ip_recursive on; proxy_set_header X-Real-IP $proxy_protocol_addr; proxy_set_header X-Fowarded-For $proxy_protocol_addr; #... } } It's really not widely used, thanks for the support plan!

gitea-mirror commented

2026-05-05 12:34:49 -06:00

Author

Owner

@fatedier commented on GitHub (Apr 10, 2019):

Supported in v0.26.0 .

@fatedier commented on GitHub (Apr 10, 2019): Supported in v0.26.0 .

gitea-mirror commented

2026-05-05 12:34:49 -06:00

Author

Owner

@nimeia commented on GitHub (Apr 13, 2019):

in v0.26.0 . not work
the nginx error log
2019/04/12 11:12:15 [error] 29287#0: 73 broken header: "GET /zh-cn/download/ HTTP/1.1^M
Host: xxxxxx
Connection: keep-alive^M
Cache-Control: max-age=0^M
Upgrade-Insecure-Requests: 1^M
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36^M
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3^M
Referer: http://xxxxxx/zh-cn/about/^M
Accept-Encoding: gzip, deflate^M
Accept-Language: zh-CN,zh;q=0.9^M
Cookie: _ga=GA1.2.1963277611.1554879062; _gid=GA1.2.2122501751.1554879062; Hm_lvt_0651a3006aeb268825e1fac075608b40=1554879071; Hm_lpvt_0651a3006aeb268825e1fac075608b40=1554994467^M
^M
" while reading PROXY protocol, client: x.x.x.x, server: 0.0.0.0:80
2019/04/12 11:12:40 [notice] 29318#0: signal process started

@nimeia commented on GitHub (Apr 13, 2019): in v0.26.0 . not work the nginx error log 2019/04/12 11:12:15 [error] 29287#0: *73 broken header: "GET /zh-cn/download/ HTTP/1.1^M Host: xxxxxx Connection: keep-alive^M Cache-Control: max-age=0^M Upgrade-Insecure-Requests: 1^M User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36^M Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3^M Referer: http://xxxxxx/zh-cn/about/^M Accept-Encoding: gzip, deflate^M Accept-Language: zh-CN,zh;q=0.9^M Cookie: _ga=GA1.2.1963277611.1554879062; _gid=GA1.2.2122501751.1554879062; Hm_lvt_0651a3006aeb268825e1fac075608b40=1554879071; Hm_lpvt_0651a3006aeb268825e1fac075608b40=1554994467^M ^M " while reading PROXY protocol, client: x.x.x.x, server: 0.0.0.0:80 2019/04/12 11:12:40 [notice] 29318#0: signal process started

gitea-mirror commented

2026-05-05 12:34:50 -06:00

Author

Owner

@dreamren commented on GitHub (Apr 17, 2019):

Supported in v0.26.0 .

Thanks, When my nginx listens on a port, it works. But when nginx listens on a UNIX domain socket, it has a problem.

Nginx configuration:

http{
    server{
        listen unix:/dev/shm/localweb.sock ssl http2 proxy_protocol;
        listen 1443 ssl http2 proxy_protocol;
        port_in_redirect off;
        set_real_ip_from unix:;
        set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;
        real_ip_recursive on;
        proxy_set_header X-Real-IP $proxy_protocol_addr;
        proxy_set_header X-Fowarded-For $proxy_protocol_addr;
        server_name xxx.xxx;
        root /www/xxx.xxx;
        include php-fpm.conf;
        index index.html index.htm index.php;
        include ssl.conf;
        ssl_certificate /etc/nginx/ssl/xxx.xxx.crt;
        ssl_certificate_key /etc/nginx/ssl/xxx.xxx.key;
    }
}

frpc.ini:

[web]
type = tcp
remote_port = 433
local_port = 1443
proxy_protocol_version = v2
[web1]
type = tcp
remote_port = 1433
plugin = unix_domain_socket
plugin_unix_path = /dev/shm/localweb.sock
proxy_protocol_version = v1
[web2]
type = tcp
remote_port = 2433
plugin = unix_domain_socket
plugin_unix_path = /dev/shm/localweb.sock
proxy_protocol_version = v2

Browser access to port 433 is normal, but port 1433 and 2433 don't work.
Attachment is nginx error log(The domain name involved has been replaced with xxx.xxx)
nginx_error.log

@dreamren commented on GitHub (Apr 17, 2019): > Supported in v0.26.0 . Thanks, When my nginx listens on a port, it works. But when nginx listens on a UNIX domain socket, it has a problem. Nginx configuration: http{ server{ listen unix:/dev/shm/localweb.sock ssl http2 proxy_protocol; listen 1443 ssl http2 proxy_protocol; port_in_redirect off; set_real_ip_from unix:; set_real_ip_from 127.0.0.1; real_ip_header proxy_protocol; real_ip_recursive on; proxy_set_header X-Real-IP $proxy_protocol_addr; proxy_set_header X-Fowarded-For $proxy_protocol_addr; server_name xxx.xxx; root /www/xxx.xxx; include php-fpm.conf; index index.html index.htm index.php; include ssl.conf; ssl_certificate /etc/nginx/ssl/xxx.xxx.crt; ssl_certificate_key /etc/nginx/ssl/xxx.xxx.key; } } frpc.ini: ``` [web] type = tcp remote_port = 433 local_port = 1443 proxy_protocol_version = v2 [web1] type = tcp remote_port = 1433 plugin = unix_domain_socket plugin_unix_path = /dev/shm/localweb.sock proxy_protocol_version = v1 [web2] type = tcp remote_port = 2433 plugin = unix_domain_socket plugin_unix_path = /dev/shm/localweb.sock proxy_protocol_version = v2 ``` Browser access to port 433 is normal, but port 1433 and 2433 don't work. Attachment is nginx error log(The domain name involved has been replaced with xxx.xxx) [nginx_error.log](https://github.com/fatedier/frp/files/3087809/nginx_error.log)

gitea-mirror commented

2026-05-05 12:34:51 -06:00

Author

Owner

@fatedier commented on GitHub (Apr 17, 2019):

Not suppoted with plugin.

I need to consider how to implement it.

@fatedier commented on GitHub (Apr 17, 2019): Not suppoted with plugin. I need to consider how to implement it.

gitea-mirror commented

2026-05-05 12:34:51 -06:00

Author

Owner

@nimeia commented on GitHub (Apr 19, 2019):

i find it can`t work in openresty (nginx sub tree), it work when i change to nginx. thank you

@nimeia commented on GitHub (Apr 19, 2019): i find it can`t work in openresty (nginx sub tree), it work when i change to nginx. thank you