AdguardTeam / AdguardTeam/AdGuardHome

Support PROXY Protocol

Offen
#2,798 45 Kommentare 92 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
feature request P3: Medium research
Vorherrschende Sprache
TypeScript
Sterne
36.9k
Forks
2.5k
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

When using AGH through a load balancer or reverse proxy (probably because I don't want to expose the AGH directly or just want to high availability), DoH can get the user's original IP address through the HTTP header but regular DNS and DoT cannot.

This isn't good for use cases where the AGH is deployed on a server. This is especially important for sites that use GeoDNS for CDN allocation because AGH needs the user's original IP to send the ECS to the recursive DNS server.

This situation is also mentioned in this issue (#1789), where @ameshkov says, "Unfortunately, there are no such options for TLS/TCP."

But in fact, both Nginx and HAProxy can use PROXY Protocol to send the user's real IP over Layer 4. nginx.com has written an article describing how to [use Nginx as a DoH / DoT gateway.](https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/) We just need to add proxy_protocol on; in the stream section to send the user's original IP via PROXY Protocol, but this requires AGH support.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.