<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body><div>On ma, 2017-08-07 at 07:49 -0400, Wayde Nie wrote:</div><blockquote type="cite">
On 08/07/2017 03:44 AM, Kees Bos wrote:, and when I do set
<blockquote type="cite" cite="mid:1502091868.14660.6.camel@gmail.com">
<blockquote type="cite">
<pre wrap="">proxy_protocol
on the listen directive I see the correct ip and port picked up and
logged in the error.log, however, then nginx stops sending the smtp
greeting... My mail client connects to my loadbalancer, the lb
connects
to nginx:587 sending the PROXY line, nginx parses and logs the PROXY
fields, then the client times out waiting for any return traffic
from
nginx... I know it's something I'm doing :-)
I'm happy to keep poking away at it, but curious mostly, if you think
the approach is sound? (ie. use $proxy_protocol_addr, set by
proxy_protocol directive and pass in to auth_http script in auth url
as
a get param?) and if an initial patch that starts by just setting
$proxy_protocol_* variables would be a useful first step in this type
of
functionality?
<blockquote type="cite"><pre wrap="">Just to get the picture right (it looks to me that your downstream smtp
server expects the proxy protocol), what's the exact flow you're trying
to accomplish?</pre>
</blockquote></pre>
</blockquote>
</blockquote>
<br>
Hi Kees,<br>
<br>
Thanks for looking!<br>
<br>
In my use case I have an external hardware loadbalancer that is
receiving end user connections on a VIP, pre-pending proxy_protocol
header and loadbalancing them to small pool of nginx servers running
as the mail proxies. Nginx is parsing the proxy_protocol header and
(I hope) proxying to my upstream smtp server without passing the
proxy_protocol header, which my upstream smtp server doesn't support
(as currently implemented).<br>
<br>
Flow like:<br>
<blockquote>1) Client makes connection to [external-LB-VIP:587] for
email submission<br>
2) [external-LB-VIP:587] --> injects proxy_protocol header
--> load balances to set of nginx services via TCP service pool
(ie: lb straight tcp, no application level inspection by
loadbalancer, other than prepending proxy_protocol header)<br>
3) Nginx parses proxy_protocol header, logs client ip and passes
client IP into auth_http script, along with username and password
for authn/authz<br>
4) on successful return response from auth_http; nginx proxies
mail submission to upstream smtp server without proxy_protocol
header.<br>
</blockquote>
<br>
So, if possible, I'd like nginx to get the client ip passed to it
from the external hardware load balancer, log it and then use it in
the auth_http script, but otherwise not pass it on to the upstream
smtp server...<br>
<br>
Is this doable?<br>
<br>
Thanks,Wayde. <br>
</blockquote><div><br></div><div>Yep. Should be.</div><div><br></div><div>I just noticed that my mail from Jul 20 is emtpy and should contain the latest patch. I've just sent the patch.</div><div><br></div><div><br></div><div>In your case, the config should probably be something like:</div><div><br></div><div><pre>mail {</pre><pre> server_name mail.example.com;</pre><pre> auth_http <auth url>;</pre><pre><br></pre><pre> server {</pre><pre> listen 587 proxy_protocol;</pre><pre> protocol smtp;</pre><pre> set_real_ip_from <external lb ip>;</pre><pre> }</pre><pre>}</pre><div><br></div></div><div><br></div><div><br></div><div><br></div><div><br></div></body></html>