在我的 Nginx 入口前使用 ELB 时，如何获得客户端的真实 IP？

Question

I have the following setup:

Client -> AWS ELB -> Nginx Ingress -> Pod

In the ELB logs, I can see the real IP of these clients. ELB sends it as the X-Forwarded-For header value to my Ingress controller.

I need to set the whitelist-source-range in the Ingress for the application, but the issue is that it uses the remote IP address, not the one in the X-Forwarded-For header.

I can see some solutions here:

1. Transform ALB into an NLB, so it preserves the originating client's IP
2. Make the Nginx controller source range whitelist based on the X-Forwarded-For header
3. Make the Nginx controller transform the request originating IP into the one in the header

The first is not ideal for me. I didn't want to maintain and pay for another load balancer. I don't know if the second is possible. I think the third is feasible, yet I have no idea how to do it. I know there's something related, which is the proxy protocol , but I don't see how it works, and I don't want to add something I don't understand into my production environment.

The load balancer is for several applications in my Kubernetes environment, so adding these IPs to the whitelist in the security group is not ideal.

How could I solve this issue?

My last resource will be to use Cloudflare. I want to keep as much of my configuration as possible inside Kubernetes, but I'll go for it if it's impossible.

Edit: this doesn't solve my problems, I have CIDRs to whitelist, not a specific IP.

Answer 1

So if you are on AWS, why are you using an Nginx Ingress controller?

You can use the AWS Load Balancer Controller , which will provision and/or manage AWS ALB's automatically.

For your particular usecase, you could add a WAF WebACL for a particular target in the ALB. You can do that manually, or use the alb.ingress.kubernetes.io/wafv2-acl-arn annotation for the AWS Load Balancer Controller.

Alternatively, you could run a separate ALB in a separate subnet, and setup IP whitelisting via the security group of that ALB's. And then make sure that separate ALB is only used for those ingresses that need it.

Again, when using the AWS Load Balancer Controller instead of the Nginx Ingress Controller, this can be done automatically, without extra maintenance.