What happened?
Hello,
I am trying to set Bunkerweb behind a Reverse Proxy(HAProxy), because it is exposed both to direct internet connection, and to an interna proxy, and so far, NGINX cannot work with both in the same port.
The problem is that BunkerWeb is not getting the real IP. After some test, two problems:
1. Wrong header:
Here is the capture of the header that BunkerWeb is sending to the backend:
X-Forwarded-For: 10.42.0.251 X-Real-IP: 10.42.0.251 X-Forwarded-Proto: https X-Forwarded-Protocol: https X-Forwarded-Host: <MY_DOMAIN> X-Forwarded-Prefix: /
The problem is that both X-Forwarded-For and X-Real-IP are wrong (I am getting the Reverse Proxy address). So, I added a new X-Forwarded-For header, but with $proxy_protocol_addr and, voila, worked. But now, I have the same header two times...
I check the configuration source and found that the variable been used is the $proxy_add_x_forwarded_for; (https://github.com/bunkerity/bunkerweb/blob/master/src/common/core/reverseproxy/confs/server-http/reverse-proxy.conf). I am not any NGINX expert, so I don't know if that is right or wrong. Just it is not working.
2. Use of REVERSE_PROXY_HEADERS
In the documentation as example, the proxy headers has to be set manually. But, without setting, they are already been passed.
https://docs.bunkerweb.io/1.6.4/features/?utm_campaign=self&utm_source=ui#configuration-guide_2
It would be better to show in the UI the headers that are set, and not to hide the 'default' ones. In this way it would be possible to resolve the first issue just changing the variable.
Version: 1.6.4
OS: Kubernetes by Helm Chart - RKE2
How to reproduce?
- Have a Bunkerweb instance behind a Reverse Proxy, with SET_PROXY_PROTOCOL option enabled.
- Set a service with reverse proxy activated.
- Set a backend in NGINX (without listening proxy_protocol) and check in the NGINX access logs for the IP address of the query.
- Now, it shows the reverse proxy and not the real IP.
Configuration file(s) (yaml or .env)
GLOBAL CONFIG:
MULTISITE=yes
DNS_RESOLVERS=rke2-coredns-rke2-coredns.kube-system.svc.cluster.local
API_WHITELIST_IP=127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
EXTERNAL_PLUGIN_URLS=https://github.com/bunkerity/bunkerweb-plugins/archive/refs/heads/dev.zip
USE_REAL_IP=yes
USE_PROXY_PROTOCOL=yes
USE_REDIS=yes
REDIS_HOST=bunkerweb-dragonfly.bunkerweb.svc.cluster.local
USE_REVERSE_PROXY=yes
UI_HOST=http://ui-bunkerweb.bunkerweb.svc.cluster.local:7000
WHITELIST_IP=
SERVICE:
IS_DRAFT=no
SERVER_NAME=<MY_DOMAIN>
USE_TEMPLATE=low
BAD_BEHAVIOR_THRESHOLD=30
BAD_BEHAVIOR_BAN_TIME=3600
USE_CORS=yes
CORS_ALLOW_ORIGIN=*
USE_DNSBL=no
KEEP_UPSTREAM_HEADERS=*
CONTENT_SECURITY_POLICY=
REFERRER_POLICY=no-referrer-when-downgrade
PERMISSIONS_POLICY=
CUSTOM_HEADER=X-Forwarded-For: $proxy_add_x_forwarded_for
COOKIE_FLAGS=* SameSite=Lax
AUTO_LETS_ENCRYPT=yes
LETS_ENCRYPT_CHALLENGE=dns
LETS_ENCRYPT_DNS_PROVIDER=cloudflare
LETS_ENCRYPT_DNS_CREDENTIAL_ITEM=api_token <TOKEN>
LIMIT_CONN_MAX_HTTP1=25
LIMIT_CONN_MAX_HTTP2=200
LIMIT_CONN_MAX_HTTP3=200
LIMIT_REQ_RATE=5r/s
ALLOWED_METHODS=GET|POST|HEAD|OPTIONS|PUT|DELETE|PATCH
MAX_CLIENT_SIZE=100m
USE_REAL_IP=yes
USE_REVERSE_PROXY=yes
REVERSE_PROXY_INTERCEPT_ERRORS=no
REVERSE_PROXY_HOST=http://10.0.211.111:81
REVERSE_PROXY_BUFFERING=no
REVERSE_PROXY_HEADERS=X-Forwarded-For $proxy_protocol_addr
WHITELIST_IP=
Relevant log output
BunkerWeb version
1.6.4
What integration are you using?
Kubernetes
Linux distribution (if applicable)
No response
Removed private data
Code of Conduct
What happened?
Hello,
I am trying to set Bunkerweb behind a Reverse Proxy(HAProxy), because it is exposed both to direct internet connection, and to an interna proxy, and so far, NGINX cannot work with both in the same port.
The problem is that BunkerWeb is not getting the real IP. After some test, two problems:
1. Wrong header:
Here is the capture of the header that BunkerWeb is sending to the backend:
X-Forwarded-For: 10.42.0.251 X-Real-IP: 10.42.0.251 X-Forwarded-Proto: https X-Forwarded-Protocol: https X-Forwarded-Host: <MY_DOMAIN> X-Forwarded-Prefix: /The problem is that both X-Forwarded-For and X-Real-IP are wrong (I am getting the Reverse Proxy address). So, I added a new X-Forwarded-For header, but with
$proxy_protocol_addrand, voila, worked. But now, I have the same header two times...I check the configuration source and found that the variable been used is the
$proxy_add_x_forwarded_for;(https://github.com/bunkerity/bunkerweb/blob/master/src/common/core/reverseproxy/confs/server-http/reverse-proxy.conf). I am not any NGINX expert, so I don't know if that is right or wrong. Just it is not working.2. Use of REVERSE_PROXY_HEADERS
In the documentation as example, the proxy headers has to be set manually. But, without setting, they are already been passed.
It would be better to show in the UI the headers that are set, and not to hide the 'default' ones. In this way it would be possible to resolve the first issue just changing the variable.
Version: 1.6.4
OS: Kubernetes by Helm Chart - RKE2
How to reproduce?
Configuration file(s) (yaml or .env)
Relevant log output
BunkerWeb version
1.6.4
What integration are you using?
Kubernetes
Linux distribution (if applicable)
No response
Removed private data
Code of Conduct