From 1104e79a2ffa1558bb774d5903e2659a5613c817 Mon Sep 17 00:00:00 2001 From: mercury Date: Fri, 18 Aug 2023 00:16:01 +0400 Subject: [PATCH] show real ip --- config/nginx.conf | 8 ++++++-- config/nginx_default.conf | 8 ++++++-- config/upstream.conf | 1 + docker-compose.yml | 2 ++ makefile | 2 ++ scripts/start_ad.sh | 1 + scripts/start_wg.sh | 4 ++-- 7 files changed, 20 insertions(+), 6 deletions(-) diff --git a/config/nginx.conf b/config/nginx.conf index 05e1955..5a0b845 100644 --- a/config/nginx.conf +++ b/config/nginx.conf @@ -16,9 +16,13 @@ http { # Proxy Cache storage - so we can cache the DoH response from the upstream proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m; + real_ip_header proxy_protocol; + real_ip_recursive on; + set_real_ip_from 10.10.0.10; + server { listen 80 default_server; - listen 443 ssl http2 default_server; + listen 443 ssl http2 default_server proxy_protocol; ssl_certificate /certs/self_public; ssl_certificate_key /certs/self_private; @@ -66,7 +70,7 @@ http { # server_name ; #-domain #-ssl - # listen 443 ssl http2; + # listen 443 ssl http2 proxy_protocol; # ssl_certificate /certs/cert_public; # ssl_certificate_key /certs/cert_private; #-ssl diff --git a/config/nginx_default.conf b/config/nginx_default.conf index 05e1955..5a0b845 100644 --- a/config/nginx_default.conf +++ b/config/nginx_default.conf @@ -16,9 +16,13 @@ http { # Proxy Cache storage - so we can cache the DoH response from the upstream proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m; + real_ip_header proxy_protocol; + real_ip_recursive on; + set_real_ip_from 10.10.0.10; + server { listen 80 default_server; - listen 443 ssl http2 default_server; + listen 443 ssl http2 default_server proxy_protocol; ssl_certificate /certs/self_public; ssl_certificate_key /certs/self_private; @@ -66,7 +70,7 @@ http { # server_name ; #-domain #-ssl - # listen 443 ssl http2; + # listen 443 ssl http2 proxy_protocol; # ssl_certificate /certs/cert_public; # ssl_certificate_key /certs/cert_private; #-ssl diff --git a/config/upstream.conf b/config/upstream.conf index 07f8f5e..8aefd91 100644 --- a/config/upstream.conf +++ b/config/upstream.conf @@ -30,6 +30,7 @@ stream { server { listen 443 reuseport; proxy_pass $sni_name; + proxy_protocol on; ssl_preread on; } diff --git a/docker-compose.yml b/docker-compose.yml index f8773b1..447a63b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -204,6 +204,8 @@ services: networks: default: ipv4_address: 10.10.0.5 + cap_add: + - NET_ADMIN command: ["/bin/sh", "/start_ad.sh"] logging: *default-logging ss: diff --git a/makefile b/makefile index 30cf35f..b7be057 100644 --- a/makefile +++ b/makefile @@ -19,6 +19,8 @@ ss: # консоль сервиса docker compose exec ss /bin/sh ng: # консоль сервиса docker compose exec ng /bin/sh +up: # консоль сервиса + docker compose exec up /bin/sh ad: # консоль сервиса docker compose exec ad /bin/sh proxy: # консоль сервиса diff --git a/scripts/start_ad.sh b/scripts/start_ad.sh index fde312e..9af9597 100644 --- a/scripts/start_ad.sh +++ b/scripts/start_ad.sh @@ -1,3 +1,4 @@ +route add -net 10.0.1.0 netmask 255.255.255.0 gw wg cat /ssh/key.pub > /root/.ssh/authorized_keys ssh-keygen -A exec /usr/sbin/sshd -D -e "$@" & diff --git a/scripts/start_wg.sh b/scripts/start_wg.sh index d3319fc..9afe837 100644 --- a/scripts/start_wg.sh +++ b/scripts/start_wg.sh @@ -6,8 +6,8 @@ then echo "PrivateKey = $PRIVATEKEY" >> /etc/wireguard/wg0.conf echo "Address = $ADDRESS" >> /etc/wireguard/wg0.conf echo "ListenPort = $WGPORT" >> /etc/wireguard/wg0.conf - echo "PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE" >> /etc/wireguard/wg0.conf - echo "PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o $INTERFACE -j MASQUERADE" >> /etc/wireguard/wg0.conf + echo "PostUp = iptables -t nat -A POSTROUTING --destination 10.10.0.5 -j ACCEPT;iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE" >> /etc/wireguard/wg0.conf + echo "PostDown = iptables -t nat -D POSTROUTING --destination 10.10.0.5 -j ACCEPT;iptables -t nat -D POSTROUTING -o $INTERFACE -j MASQUERADE" >> /etc/wireguard/wg0.conf fi sed "s/ListenPort = [0-9]\+/ListenPort = $WGPORT/" /etc/wireguard/wg0.conf > change_port cat change_port > /etc/wireguard/wg0.conf