real-ip

Description

The real-ip Plugin is used to dynamically change the client’s IP address and port as seen by APISIX.

This is more flexible but functions similarly to Nginx’s ngx_http_realip_module.

real-ip - 图1IMPORTANT

This Plugin requires APISIX to run on APISIX-Base.

Attributes

NameTypeRequiredValid valuesDescription
sourcestringTrueAny Nginx variable like arg_realip or http_x_forwarded_for.Dynamically sets the client’s IP address and an optional port from APISIX’s view.
trusted_addressesarray[string]FalseList of IPs or CIDR ranges.Dynamically sets the set_real_ip_from field.
recursivebooleanFalseTrue to enable, false to disable, default is falseIf recursive search is disabled, the original client address that matches one of the trusted addresses is replaced by the last address sent in the configured source. If recursive search is enabled, the original client address that matches one of the trusted addresses is replaced by the last non-trusted address sent in the configured source.
real-ip - 图2note

If the address specified in source is missing or invalid, the Plugin would not change the client address.

Enabling the Plugin

The example below enables the real-ip Plugin on the specified Route:

  1. curl -i http://127.0.0.1:9180/apisix/admin/routes/1  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3.     "uri": "/index.html",
  4.     "plugins": {
  5.         "real-ip": {
  6.             "source": "arg_realip",
  7.             "trusted_addresses": ["127.0.0.0/24"]
  8.         },
  9.         "response-rewrite": {
  10.             "headers": {
  11.                 "remote_addr": "$remote_addr",
  12.                 "remote_port": "$remote_port"
  13.             }
  14.         }
  15.     },
  16.     "upstream": {
  17.         "type": "roundrobin",
  18.         "nodes": {
  19.             "127.0.0.1:1980": 1
  20.         }
  21.     }
  22. }'

Example usage

After you have enabled the Plugin as mentioned above, you can test it as shown below:

  1. curl 'http://127.0.0.1:9080/index.html?realip=1.2.3.4:9080' -I
  1. ...
  2. remote-addr: 1.2.3.4
  3. remote-port: 9080

Disable Plugin

To disable the real-ip Plugin, you can delete the corresponding JSON configuration from the Plugin configuration. APISIX will automatically reload and you do not have to restart for this to take effect.

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3.     "uri": "/index.html",
  4.     "upstream": {
  5.         "type": "roundrobin",
  6.         "nodes": {
  7.             "127.0.0.1:1980": 1
  8.         }
  9.     }
  10. }'