Whitelisting by remote_addr, not by $the_real_ip (X-Forwarded-For) #2257

maxpain · 2018-03-26T11:12:44Z

Is this a BUG REPORT or FEATURE REQUEST?: FEATURE REQUEST

NGINX Ingress controller version: 0.11.0

Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.3", GitCommit:"d2835416544f298c919e2ead3be3d0864b52323b", GitTreeState:"clean", BuildDate:"2018-02-09T21:51:06Z", GoVersion:"go1.9.4", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.5+coreos.0", GitCommit:"0d082e389e1f4311dc5d225eb77f9688c50d340a", GitTreeState:"clean", BuildDate:"2018-03-21T21:10:44Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}

Environment:

Cloud provider or hardware configuration: Bare-metal (5 dedicated servers)
OS (e.g. from /etc/os-release):

NAME="Ubuntu"
VERSION="16.04.4 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.4 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial

Kernel (e.g. uname -a):

Linux dropkube1 4.13.0-37-generic #42~16.04.1-Ubuntu SMP Wed Mar 7 16:03:28 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

What happened:
I need to whitelist my nginx ingress with CloudFlare IP ranges and simultaneously use proxy-real-ip-cidr + forwarded-for-header: "cf-connecting-ip" for retrieving real client's ip address. How can I do this?
At this moment i can whitelist only by $the_real_ip, which is actually a X-Forwarded-For header or forwarded-for-header setting from ConfigMap (for me it's a cf-connecting-ip)

map $http_cf_connecting_ip $the_real_ip {

    default          $remote_addr;

}

The text was updated successfully, but these errors were encountered:

aledbf · 2018-03-26T11:26:46Z

@Maxpain177 you can do that using forwarded-for-header: CF-Connecting-IP in the configuration configmap

maxpain · 2018-03-26T11:28:14Z

It will be cool, if you add the ability to change $the_real_ip to another header (e.g. $remote_addr) at this part:

geo $the_real_ip $deny_tpNsjYzYpsBМMxsfPXOCshLDuMwCsaZP {
        default 1;

        103.21.244.0/22 0;
        103.22.200.0/22 0;
        103.31.4.0/22 0;
        104.16.0.0/12 0;
        108.162.192.0/18 0;
        131.0.72.0/22 0;
        141.101.64.0/18 0;
        162.158.0.0/15 0;
        172.64.0.0/13 0;
        173.245.48.0/20 0;
        188.114.96.0/20 0;
        190.93.240.0/20 0;
        197.234.240.0/22 0;
        198.41.128.0/17 0;
    }

maxpain · 2018-03-26T11:32:58Z

@aledbf, I'm already using forwarded-for-header: CF-Connecting-IP and it's change $the_real_ip, which is used in geo nginx's directive for whitelisting. I need to change $the_real_ip in geo directive to $remote_addr.

apolovov · 2018-04-01T17:03:07Z

I need ability to allow traffic from CDN (not only CloudFlare) and disallow all other traffic. The same time I need to resolve end-user IP from X-Forwarded-For (or CF-Connecting-IP) header to see it in ingress logs and applications.

Simple whitelist dont work because it use client ip which overwritten by forwarded-for-header.

maxpain · 2018-04-05T11:45:21Z

Any updates?

fejta-bot · 2018-07-04T12:36:44Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

victorboissiere · 2018-07-05T13:04:03Z

Yes any updates? Please don't close this issue.

fejta-bot · 2018-08-04T13:48:28Z

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

fejta-bot · 2018-09-03T14:34:46Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

k8s-ci-robot · 2018-09-03T14:34:53Z

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

maxpain · 2018-09-03T16:01:17Z

/reopen

k8s-ci-robot · 2018-09-03T16:01:24Z

@Maxpain177: Reopening this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fejta-bot · 2018-10-03T16:59:00Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

k8s-ci-robot · 2018-10-03T16:59:07Z

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

maxpain · 2018-10-03T21:29:04Z

/reopen

k8s-ci-robot · 2018-10-03T21:29:11Z

@Maxpain177: Reopening this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jdanlewis · 2018-10-16T23:33:44Z

I was able to achieve a similar use case using the following ConfigMap data on NGINX Ingress Controller v0.17.1:

http-snippet: |
	map $realip_remote_addr $deny_sidedoor {
		default 1;
		<load balancer IP> 0;
	}
server-snippet: |
	if ($deny_sidedoor) { return 403; }

fejta-bot · 2018-11-15T23:59:12Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

k8s-ci-robot · 2018-11-15T23:59:19Z

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sentanos · 2019-07-22T22:05:41Z

/reopen

k8s-ci-robot · 2019-07-22T22:05:48Z

@sentanos: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

maxpain · 2019-07-23T09:06:01Z

/reopen

k8s-ci-robot · 2019-07-23T09:06:08Z

@Maxpain177: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fejta-bot · 2019-08-22T09:51:06Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

k8s-ci-robot · 2019-08-22T09:55:09Z

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Routhinator · 2020-04-14T17:56:18Z

This issue is still unresolved and unanswered with an appropriate workaround. Changing the x forwarded for reference will break downstream application behaviour that needs the actual real IP - we need a way to whitelist based on source IP instead of real IP while maintaining the x-forwarded-for header.

Routhinator · 2020-04-14T17:56:45Z

@Maxpain177 need to re-open this again

maxpain · 2020-04-16T06:58:05Z

/reopen

k8s-ci-robot · 2020-04-16T06:58:26Z

@Maxpain177: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

aledbf · 2020-04-19T01:12:36Z

Closing. @Routhinator if you see this issue, please open a new one. Also please use the template issue so we can reproduce it.

aledbf · 2020-04-19T01:13:55Z

Whitelisting by remote_addr, not by $the_real_ip (X-Forwarded-For)

The variable $the_real_ip was removed in 0.26.0 #4557

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 4, 2018

javipolo mentioned this issue Jul 31, 2018

Use X-forwarded-for for whitelisting (enabled per ingress via annotation) #2881

Closed

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Aug 4, 2018

k8s-ci-robot closed this as completed Sep 3, 2018

k8s-ci-robot reopened this Sep 3, 2018

k8s-ci-robot closed this as completed Oct 3, 2018

k8s-ci-robot reopened this Oct 3, 2018

k8s-ci-robot closed this as completed Nov 15, 2018

k8s-ci-robot reopened this Jul 23, 2019

k8s-ci-robot closed this as completed Aug 22, 2019

k8s-ci-robot reopened this Apr 16, 2020

aledbf closed this as completed Apr 19, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Whitelisting by remote_addr, not by $the_real_ip (X-Forwarded-For) #2257

Whitelisting by remote_addr, not by $the_real_ip (X-Forwarded-For) #2257

maxpain commented Mar 26, 2018

aledbf commented Mar 26, 2018

maxpain commented Mar 26, 2018 •

edited

Loading

maxpain commented Mar 26, 2018 •

edited

Loading

apolovov commented Apr 1, 2018

maxpain commented Apr 5, 2018

fejta-bot commented Jul 4, 2018

victorboissiere commented Jul 5, 2018

fejta-bot commented Aug 4, 2018

fejta-bot commented Sep 3, 2018

k8s-ci-robot commented Sep 3, 2018

maxpain commented Sep 3, 2018

k8s-ci-robot commented Sep 3, 2018

fejta-bot commented Oct 3, 2018

k8s-ci-robot commented Oct 3, 2018

maxpain commented Oct 3, 2018

k8s-ci-robot commented Oct 3, 2018

jdanlewis commented Oct 16, 2018

fejta-bot commented Nov 15, 2018

k8s-ci-robot commented Nov 15, 2018

sentanos commented Jul 22, 2019

k8s-ci-robot commented Jul 22, 2019

maxpain commented Jul 23, 2019

k8s-ci-robot commented Jul 23, 2019

fejta-bot commented Aug 22, 2019

k8s-ci-robot commented Aug 22, 2019

Routhinator commented Apr 14, 2020

Routhinator commented Apr 14, 2020

maxpain commented Apr 16, 2020

k8s-ci-robot commented Apr 16, 2020

aledbf commented Apr 19, 2020

aledbf commented Apr 19, 2020 •

edited

Loading

Whitelisting by remote_addr, not by $the_real_ip (X-Forwarded-For) #2257

Whitelisting by remote_addr, not by $the_real_ip (X-Forwarded-For) #2257

Comments

maxpain commented Mar 26, 2018

aledbf commented Mar 26, 2018

maxpain commented Mar 26, 2018 • edited Loading

maxpain commented Mar 26, 2018 • edited Loading

apolovov commented Apr 1, 2018

maxpain commented Apr 5, 2018

fejta-bot commented Jul 4, 2018

victorboissiere commented Jul 5, 2018

fejta-bot commented Aug 4, 2018

fejta-bot commented Sep 3, 2018

k8s-ci-robot commented Sep 3, 2018

maxpain commented Sep 3, 2018

k8s-ci-robot commented Sep 3, 2018

fejta-bot commented Oct 3, 2018

k8s-ci-robot commented Oct 3, 2018

maxpain commented Oct 3, 2018

k8s-ci-robot commented Oct 3, 2018

jdanlewis commented Oct 16, 2018

fejta-bot commented Nov 15, 2018

k8s-ci-robot commented Nov 15, 2018

sentanos commented Jul 22, 2019

k8s-ci-robot commented Jul 22, 2019

maxpain commented Jul 23, 2019

k8s-ci-robot commented Jul 23, 2019

fejta-bot commented Aug 22, 2019

k8s-ci-robot commented Aug 22, 2019

Routhinator commented Apr 14, 2020

Routhinator commented Apr 14, 2020

maxpain commented Apr 16, 2020

k8s-ci-robot commented Apr 16, 2020

aledbf commented Apr 19, 2020

aledbf commented Apr 19, 2020 • edited Loading

maxpain commented Mar 26, 2018 •

edited

Loading

maxpain commented Mar 26, 2018 •

edited

Loading

aledbf commented Apr 19, 2020 •

edited

Loading