Closed djenriquez closed 4 years ago
@leprechau, sounds like its been decided from here that RemoteAddr must always be checked eh? https://github.com/fabiolb/fabio/pull/442#discussion_r167756741
Hmmm, actually I wonder if the RemoteAddr from a public facing LB is actually its internal IP address, then this isn't an issue since we can allow the internal subnet as a whole.
Confirmed, RemoteAddr is a private IP. This isn't an issue anymore :wink:.
It seems it becomes necessary that the
allow:
rule includes the IP of the AWS LBs, since they always become theRemoteAddr
, however, this is especially painful for public LBs since those change to whatever IP at random, given:We have an unfortunate URI based routing complexity where some routes should only allow "internal" traffic, but most everything else should be public. This requires Fabio to be fronted by a public facing LB. For certain paths, we want only a defined set of IPs access, but because the access control requires the LB's IP, which is always changing, this definition becomes impossible without allowing the entirety of AWS owned IPs.
Is there a way to disable the
RemoteAddr
check and instead just look to see if any IPs match inX-Forwarded-For
, or possibly apply OR logic instead of AND?