去年就開始使用CloudFlare為網站加速，因為當時那個網站與訪問者IP地址關系不大，所以沒有特别處理CDN代理IP和訪問者真實IP。今年添加的一個網站在做爬蟲屏蔽的時候與用戶真實IP有關，臨時可以用簡易的方式在PHP程序中獲取：
if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
} elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
不過這樣的話，如果有人故意在http head中添加假的'HTTP_CF_CONNECTING_IP'和'HTTP_X_FORWARDED_FOR'的時候，我們就會上當，存在安全隐患。
後來找到一個Apache上為CloudFlare開發的模塊mod_cloudflare，安裝後就可以解決上述問題。
但我們後來接入百度雲加速就沒有辦法使用mod_cloudflare來顯示真實IP了，在CloudFlare的官方網站幫助文件中說mod_cloudflare也不推薦，而是推薦mod_remoteip這個模塊。
Apache 2.4是直接啟用mod_remoteip，我們現在的Apache 2.2是下載mod_remoteip-httpd22安裝。
可以從Linux服務器上使用如下命令：
wget https://github.com/ttkzw/mod_remoteip-httpd22/archive/refs/heads/master.zip， unzip mod_remoteip-httpd22-master.zip cd mod_remoteip-httpd22-master apxs -i -c -n mod_remoteip.so mod_remoteip.c cp -pa /usr/lib64/httpd/modules/mod_remoteip.so /usr/local/apache/modules/
再修改httpd.conf：
#LoadModule cloudflare_module modules/mod_cloudflare.so LoadModule remoteip_module modules/mod_remoteip.so <IfModule remoteip_module> # 2021-5-29 # 接入了CloudFlare和百度雲加速 # mod_remoteip-httpd22 # https://github.com/ttkzw/mod_remoteip-httpd22 # https://support.cloudflare.com/hc/en-us/articles/200170786 # https://www.cloudflare.com/ips/ RemoteIPHeader CF-Connecting-IP RemoteIPTrustedProxy 103.21.244.0/22 RemoteIPTrustedProxy 103.22.200.0/22 RemoteIPTrustedProxy 103.31.4.0/22 RemoteIPTrustedProxy 104.16.0.0/13 RemoteIPTrustedProxy 104.24.0.0/14 RemoteIPTrustedProxy 108.162.192.0/18 RemoteIPTrustedProxy 131.0.72.0/22 RemoteIPTrustedProxy 141.101.64.0/18 RemoteIPTrustedProxy 162.158.0.0/15 RemoteIPTrustedProxy 172.64.0.0/13 RemoteIPTrustedProxy 173.245.48.0/20 RemoteIPTrustedProxy 188.114.96.0/20 RemoteIPTrustedProxy 190.93.240.0/20 RemoteIPTrustedProxy 197.234.240.0/22 RemoteIPTrustedProxy 198.41.128.0/17 RemoteIPTrustedProxy 2400:cb00::/32 RemoteIPTrustedProxy 2606:4700::/32 RemoteIPTrustedProxy 2803:f800::/32 RemoteIPTrustedProxy 2405:b500::/32 RemoteIPTrustedProxy 2405:8100::/32 RemoteIPTrustedProxy 2a06:98c0::/29 RemoteIPTrustedProxy 2c0f:f248::/32 # 百度雲加速節點IP地址段（2021年3月2日更新） # https://su.baidu.com/help/index.html#/10_changjianwenti/0_HIDE_FAQ/20_baiduyunjiasujiedianIPdizhiduan.md RemoteIPHeader X-Forwarded-For # 天津 RemoteIPTrustedProxy 111.32.135.0/24 RemoteIPTrustedProxy 111.32.136.0/24 RemoteIPTrustedProxy 111.32.134.0/24 RemoteIPTrustedProxy 125.39.174.0/24 RemoteIPTrustedProxy 125.39.239.0/24 RemoteIPTrustedProxy 125.39.238.0/24 RemoteIPTrustedProxy 42.81.6.0/24 RemoteIPTrustedProxy 42.81.8.0/24 # 重慶 RemoteIPTrustedProxy 119.84.92.0/24 RemoteIPTrustedProxy 119.84.93.0/24 RemoteIPTrustedProxy 113.207.100.0/24 RemoteIPTrustedProxy 113.207.101.0/24 RemoteIPTrustedProxy 113.207.102.0/24 RemoteIPTrustedProxy 221.178.56.0/24 RemoteIPTrustedProxy 221.178.57.0/24 RemoteIPTrustedProxy 221.178.58.0/26 RemoteIPTrustedProxy 119.84.1.0/24 # 上海 RemoteIPTrustedProxy 180.163.188.0/24 RemoteIPTrustedProxy 101.227.206.0/24 RemoteIPTrustedProxy 101.227.207.0/24 RemoteIPTrustedProxy 180.163.113.0/24 RemoteIPTrustedProxy 180.163.189.0/24 RemoteIPTrustedProxy 180.163.154.0/24 RemoteIPTrustedProxy 180.163.153.0/24 # 河北 RemoteIPTrustedProxy 61.182.137.0/24 RemoteIPTrustedProxy 61.182.136.0/24 RemoteIPTrustedProxy 220.195.22.0/24 RemoteIPTrustedProxy 220.195.21.0/25 RemoteIPTrustedProxy 111.63.67.0/24 RemoteIPTrustedProxy 111.63.68.0/24 # 西安 RemoteIPTrustedProxy 117.34.13.0/24 RemoteIPTrustedProxy 117.34.14.0/24 RemoteIPTrustedProxy 117.34.28.0/24 RemoteIPTrustedProxy 117.34.60.0/24 RemoteIPTrustedProxy 117.34.61.0/24 RemoteIPTrustedProxy 117.34.62.0/24 # 濟南 RemoteIPTrustedProxy 119.188.97.0/24 RemoteIPTrustedProxy 119.188.9.0/24 RemoteIPTrustedProxy 119.188.14.0/24 RemoteIPTrustedProxy 119.188.132.0/24 RemoteIPTrustedProxy 60.217.232.0/24 # 廣州 RemoteIPTrustedProxy 183.232.51.0/24 RemoteIPTrustedProxy 183.232.53.0/24 RemoteIPTrustedProxy 157.255.25.0/24 RemoteIPTrustedProxy 157.255.26.0/24 RemoteIPTrustedProxy 157.255.24.0/24 # 江蘇 RemoteIPTrustedProxy 112.25.89.0/24 RemoteIPTrustedProxy 112.25.90.0/24 RemoteIPTrustedProxy 112.25.91.0/24 # 湖北 RemoteIPTrustedProxy 122.190.1.0/24 RemoteIPTrustedProxy 122.190.2.0/24 RemoteIPTrustedProxy 122.190.3.0/24 RemoteIPTrustedProxy 111.174.63.0/24 RemoteIPTrustedProxy 111.174.61.0/24 # 青島 RemoteIPTrustedProxy 119.167.246.0/24 RemoteIPTrustedProxy 150.138.149.0/24 RemoteIPTrustedProxy 150.138.150.0/24 RemoteIPTrustedProxy 150.138.151.0/24 # 湖南 RemoteIPTrustedProxy 59.51.81.128/25 RemoteIPTrustedProxy 220.170.184.0/24 RemoteIPTrustedProxy 220.170.185.0/24 RemoteIPTrustedProxy 220.170.186.0/24 # 蘇州 RemoteIPTrustedProxy 61.155.149.0/24 RemoteIPTrustedProxy 61.156.149.0/24 RemoteIPTrustedProxy 61.155.165.0/24 RemoteIPTrustedProxy 58.211.2.0/24 RemoteIPTrustedProxy 58.211.137.0/24 # 佛山 RemoteIPTrustedProxy 183.60.235.0/24 RemoteIPTrustedProxy 116.31.126.0/24 RemoteIPTrustedProxy 116.31.127.0/24 # 東莞 RemoteIPTrustedProxy 183.61.236.0/24 RemoteIPTrustedProxy 14.17.71.0/24 RemoteIPTrustedProxy 119.147.134.0/24 RemoteIPTrustedProxy 183.61.177.0/24 RemoteIPTrustedProxy 183.61.190.0/24 # 合肥 RemoteIPTrustedProxy 112.29.157.0/24 RemoteIPTrustedProxy 112.29.158.0/24 RemoteIPTrustedProxy 112.29.159.0/24 # 鄭州 RemoteIPTrustedProxy 42.236.93.0/24 RemoteIPTrustedProxy 42.236.94.0/24 RemoteIPTrustedProxy 42.236.7.128/26 RemoteIPTrustedProxy 42.236.7.65/27 # 沈陽 RemoteIPTrustedProxy 124.95.168.128/25 RemoteIPTrustedProxy 124.95.188.0/24 RemoteIPTrustedProxy 124.95.191.0/24 # 甯波 RemoteIPTrustedProxy 115.231.186.0/24 RemoteIPTrustedProxy 115.231.187.0/24 RemoteIPTrustedProxy 122.246.5.0/24 # 湖州 RemoteIPTrustedProxy 61.241.118.0/24 RemoteIPTrustedProxy 101.69.175.0/24 # 南甯 RemoteIPTrustedProxy 222.216.190.0/24 RemoteIPTrustedProxy 219.159.84.0/24 # 金華 RemoteIPTrustedProxy 117.147.214.0/24 RemoteIPTrustedProxy 117.147.215.0/24 # 福州 RemoteIPTrustedProxy 117.27.149.0/24 # 北京 RemoteIPTrustedProxy 111.132.134.0/24 </IfModule>
再重啟apache就可以了。
用以上辦法設置後，我都在Drupal網站的日志中查看訪問者IP（我自己來訪問一個不存在的頁面），如果日志中是真實IP就說明設置成功了。
注意如果以後CloudFlare或者百度雲加速的IP名單有變化的話，也需要修改這裡的配置中的列表。
自由标簽
评论