AdguardTeam / AdguardTeam/AdGuardHome

Support PROXY Protocol

Aberta
#2,798 45 comentários 92 reações 0 responsáveis Ver no GitHub
feature request P3: Medium research
Linguagem predominante
TypeScript
Estrelas
36.9k
Forks
2.5k
Métricas de merge de PRs
Nenhum PR com merge em 30d

Descrição

When using AGH through a load balancer or reverse proxy (probably because I don't want to expose the AGH directly or just want to high availability), DoH can get the user's original IP address through the HTTP header but regular DNS and DoT cannot.

This isn't good for use cases where the AGH is deployed on a server. This is especially important for sites that use GeoDNS for CDN allocation because AGH needs the user's original IP to send the ECS to the recursive DNS server.

This situation is also mentioned in this issue (#1789), where @ameshkov says, "Unfortunately, there are no such options for TLS/TCP."

But in fact, both Nginx and HAProxy can use PROXY Protocol to send the user's real IP over Layer 4. nginx.com has written an article describing how to [use Nginx as a DoH / DoT gateway.](https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/) We just need to add proxy_protocol on; in the stream section to send the user's original IP via PROXY Protocol, but this requires AGH support.

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.