![HAProxy 配置中的多个 forwardfor 命令](https://linux22.com/image/765426/HAProxy%20%E9%85%8D%E7%BD%AE%E4%B8%AD%E7%9A%84%E5%A4%9A%E4%B8%AA%20forwardfor%20%E5%91%BD%E4%BB%A4.png)
在 HAProxy 中,我希望forwardfor
除了下面几个网络(多个网络)之外的所有内容
frontend main
bind myip:5356-60000
mode http
option http_proxy
option forwardfor except 127.0.0.0/8 #1st network
option forwardfor except 1.1.1.1/32 #2nd network
option forwardfor except 2.2.2.2/32 #3rd network
option forwardfor except 3.3.3.3/32 #4th network
maxconn 950
timeout client 30s
default_backend mybackendserver
这不起作用,它不转发所有指定的网络,而是只转发最后一个(第 4 个网络)。
每个option forwardfor except my-network-here
命令都会覆盖前一个命令,而不是追加它们。如何实现转发除多个网络白名单之外的所有内容?
答案1
我最终使用了一种有点 hack 的解决方案,虽然这不是我的第一选择,但可以满足我的需求。在 haproxy 配置中,我使用了一个 acl 白名单,其中包含我不希望转发的所有 ip。如果请求来自白名单中存在的 ip,haproxy 将使用与第一个后端相同的第二个后端,只是它不转发。我基本上将 forwardfor 选项移到了后端部分而不是前端。
所以,
frontend main
bind myip:5356-60000
mode http
option http_proxy
maxconn 950
timeout client 30s
acl white_list_noforward src 1.1.1.1 2.2.2.2 3.3.3.3 etc..
#explanation: if the ip is not found in the whitelist, use the backend_that_forwards, else, and the ip is in the whitelist use the backend_that_DOESNT_forward
use_backend backend_that_forwards if !white_list_noforward
use_backend backend_that_DOESNT_forward if white_list_noforward
#default to the backend that forwards just in case something goes wrong
default_backend use_backend backend_that_forwards
backend_that_forwards #forwards client ip
mode http
option forwardfor except 127.0.0.0/8 # <-- THIS forwards the real client ip except 127.0.0.0/8
balance roundrobin
timeout connect 5s
timeout server 5s
server static 127.0.0.1:80 # same server for both backends
backend_that_DOESNT_forward #DOES NOT forward the client-ip (No option forwardfor is used here), used to handle all requests coming in from ips that I do not wish to forward for
mode http
balance roundrobin
timeout connect 5s
timeout server 5s
server static 127.0.0.1:80 # same server for both backends