DNSCrypt / doh-server

Fast, mature, secure DoH and ODoH server proxy written in Rust. Previously known as doh-proxy and rust-doh.
MIT License
764 stars 63 forks source link

ECS support in nginx reverse proxy #100

Open 9bingyin opened 1 month ago

9bingyin commented 1 month ago

I use Nginx to reverse proxy to doh-proxy because I want to use multiple paths to distinguish between different sources of DoH requests. However, I find that regardless of whether I use X-Real-IP or X-Forwarded-For to pass the upstream IP, it ultimately does not get applied to doh-proxy. However, the ECS directly attached by the upstream client (e.g., dig +subnet) is passed through.

I also didn't see any related information in the Usage section. Does doh-proxy not support this feature, or could there be an issue with my configuration?

jedisct1 commented 1 month ago

The server doesn't add the client subnet implicitly. It's only sent to upstream servers if the client explicitly asked for it (for example by setting the edns_client_subnet parameter in dnscrypt-proxy).

From a privacy perspective, this is much better that way.

But I can try to add an option to do it implicitly, even though it would be disabled by default.