TCP四層代理透傳客戶端真實IP

緣起

最近公司準備自建郵箱，大概十年前折騰過自建郵箱的事情，感受坑不少，此次體會了下確實不少，特別是如今管局對郵箱端口管控愈來愈嚴格的狀況下，不少以前能行得通的方案須要修改下。
因爲SMTP、POP三、IMAP等協議須要作四層代理且還須要能穿透客戶端真實IP，硬件網絡層代理軟件又不能使用的狀況下只能考慮軟代理，下面是記錄的兩種解決方案。

方案

Nginx解決方案

1.注意nginx編譯時須要加上stream模塊及stream_realip_module模塊;一個用來四層負載，一個用來獲取客戶端真實IP
2.開啓透傳功能proxy_protocol on，用於將鏈接信息從請求鏈接的源傳遞到請求鏈接到的目標

具體配置以下

# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.16.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx  --with-stream --with-stream_realip_module

# cat /usr/local/nginx/conf/nginx.conf

user  nginx;
worker_processes  auto;

events {
    worker_connections  10240;
    }
include tcp/*.conf;

# cat /usr/local/nginx/conf/tcp/mail.conf

stream {
    log_format proxy '$remote_addr [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time "$upstream_addr" '
                 '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';

    access_log /usr/local/nginx/logs/mail.log proxy;

    upstream mail_http {
        server 192.168.188.88:80 ;
    }
    server {
        listen 80;
        proxy_connect_timeout 10s;
        proxy_timeout 30s;
        proxy_pass mail_web;
    }

    upstream mail_https {
        server 192.168.188.88:443 ;
    }
    server {
        listen 443;
        proxy_connect_timeout 10s;
        proxy_timeout 30s;
        proxy_pass mail_https;
    }

    upstream mail_smtp {
        server 192.168.188.88:25 ;
    }
    server {
        listen 25 ;
        proxy_connect_timeout 10s;
        proxy_timeout 300s;
        proxy_protocol on ;
        proxy_pass mail_smtp;
    }

    upstream mail_smtps {
        server 192.168.188.88:465 ;
    }
    server {
        listen 465;
        proxy_connect_timeout 10s;
        proxy_timeout 30s;
        proxy_protocol on ;
        proxy_pass mail_smtps;
    }

    upstream mail_pop3 {
        server 192.168.188.88:110 ;
    }
    server {
        listen 110;
        proxy_connect_timeout 10s;
        proxy_timeout 30s;
        proxy_protocol on ;
        proxy_pass mail_pop3;
    }

    upstream mail_pop3s {
        server 192.168.188.88:995 ;
    }
    server {
        listen 995;
        proxy_connect_timeout 10s;
        proxy_timeout 30s;
        proxy_protocol on ;
        proxy_pass mail_pop3s;
    }

    upstream mail_imap {
        server 192.168.188.88:143 ;
    }
    server {
        listen 143;
        proxy_connect_timeout 10s;
        proxy_timeout 30s;
        proxy_protocol on ;
        proxy_pass mail_imap;
    }

    upstream mail_imaps {
        server 192.168.188.88:993 ;
    }
    server {
        listen 993;
        proxy_connect_timeout 10s;
        proxy_timeout 30s;
        proxy_protocol on ;
        proxy_pass mail_imaps;
    }

}

Haproxy解決方案

1.開通tcp 模式 mode tcp
2.開啓透傳 send-proxy
注意：基本上haproxy參數需結合haproxy -c測試，一條條的來過才能肯定最終哪一個參數起做用

# haproxy -v
HA-Proxy version 1.5.18 2016/05/10
Copyright 2000-2016 Willy Tarreau <willy@haproxy.org>

# cat /etc/haproxy/haproxy.cf
listen stats
 mode http
 bind 0.0.0.0:9999
 stats enable
 log global
 stats uri     /haproxy-status
 stats auth    haadmin:yourpassword

listen WEB
    bind 80
    mode http
    server web01 192.168.188.88:80  check 

listen WEBSSL
    bind 443
    mode tcp
    server webssl01 192.168.188.88:443  check 

listen MAIL
    bind 25
    mode tcp
    server mail01 192.168.188.88:25  check send-proxy

listen MAILS
    bind 465
    mode tcp
    server mailssl01 192.168.188.88:465  check send-proxy

listen POP3
    bind 110
    mode tcp
    server pop301 192.168.188.88:110  check send-proxy

listen POP3S
    bind 995 
    mode tcp
    server pop3ssl01 192.168.188.88:995  check send-proxy

listen IMAP
    bind 143
    mode tcp
    server imap01 192.168.188.88:143  check send-proxy

listen IMAPS
    bind 993
    mode tcp
    server imapssl01 192.168.188.88:993  check send-proxy

尾聲

固然了，這只是自建郵件服務器其中一個小小的問題，基本上一步一個問題，因此如今自建郵箱愈來愈少了，基本上都被雲郵箱取代了，就連Postfix 2012年的時候都中止更新維護了，估計再後來懂這門手藝的人會愈來愈少了。