Is it possible to preserve request originator IP/Hostname ? about ghostunnel

[csstaub]

Ghostunnel is a just transport layer proxy, it is agnostic about the protocol running on top. Any mechanism for preserving information about originators of requests would have to be application-specific (such as a X-Forwarded-IP header in an HTTP request). I'm not very familiar with Redis replication but I believe there is no mechanism for that at the moment.

[mbyczkowski]

Hey @satheeshaGowda, I'm not sure if that solves your problem, but Redis has some options where you can specify what IP/PORT is being announced by sentinel (in sentinel.conf):

# sentinel announce-ip <ip>
# sentinel announce-port <port>

or the node itself (in redis.conf):

# slave-announce-ip <ip>
# slave-announce-port <port>

[mcpherrinm]

I'm not sure there's a straightforward solution to this problem. When a connection comes in, it'll be TCP & TLS terminated, and then the server will see a localhost src IP.

To support having the "real" client IP as the source, you'd have to have something rewrite the source IP to be the real one, and ensure traffic sent back is routed appropriately to localhost.

I think either you'd need to do something in the OS network stack (ie, have ghostunnel install a NAT rule per incoming IP), and probably use network namespaces to isolate that.... Seems really messy.

Either that or some other mechanism to convince the service it's talking to the real client IP... I have no idea how to do this successfully in Linux.

It's certainly possible (Amazon's NLBs when TLS terminating do this, just announced). But doing it when you don't control the whole network stack; that seems trickier.

I don't think any of the existing ghostunnel contributers have the time to design and implement this, though if there's a reasonable design proposed, we may be able to accept an implementation.

[csstaub]

Update: Just merged support for the PROXY protocol (see #207), which could help with this if Redis also adopts support for the PROXY protocol.