Repository navigation
docs: Cloudflare 在前不用再配来源地址；别家 CDN 用 realip - #9
Merged
Merged
Conversation
原来建议的 `proxy_set_header X-Forwarded-For $http_cf_connecting_ip;` 无条件信任这个头： 有人绕过 Cloudflare 直连源站时由他自己填，登录限流拦不住，也能把管理员锁在登录页外。 hub 现在认得 Cloudflare 的网段，只在连接来自那里时读 CF-Connecting-IP。 别家 CDN 改用 nginx 的 realip 模块，只信任 CDN 的回源网段。
- 跟随 monitor#30 的修正：hub 只在验过节点 token 的连接上读 CF-Connecting-IP，登录限流不读， 因为 Worker 也能从 Cloudflare 网络连到源站并写这个头。写明开了代理时限流仍按边缘计。 - 别家 CDN 补上 caddy 的 trusted_proxies 写法，nginx 写法注明需要 realip 模块。 - 隧道先到本机 nginx 再到 hub 时，链尾是 127.0.0.1，同样用 realip，set_real_ip_from 填 127.0.0.1。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
配套 monitor-probe/monitor#30。
改动
反向代理 · 注意事项 3
CF-Connecting-IP。登录限流不读这个头：Worker 也能从 Cloudflare 网络连到源站并写它。写明开了代理时限流仍按边缘地址计trusted_proxies写法，都只信任列出的网段proxy_set_header X-Forwarded-For $http_cf_connecting_ip;，并提醒照写过的人去掉：有人绕过 Cloudflare 直连源站时这个头由他自己填，换着值试密码就绕过了登录限流，填上管理员的地址还能把人锁在登录页外 15 分钟FAQ · 节点地址是内网 IP，或者国家码不对
「自动判断不了的」列表补一条：套了 Cloudflare 以外的 CDN 时，出口是边缘的地址，指向上面的 realip 配置。
验证
独立的 network namespace 里实测，结果见 monitor#30 的表格：
CF-Connecting-IP会被 hub 当成来源合并时机
等含 monitor#30 的 hub 发版后再合：旧版 hub 不读
CF-Connecting-IP，「不用额外配置」对它不成立。