lb trusted-proxy

The lb trusted-proxy command creates the trusted proxy profiles that determine from which header the real address of the client will be read and in the requests coming from which networks this header will be trusted. Its panel equivalent is the Trusted Proxy screen.

If there is a load balancer, a CDN or a proxy server in front of TR7, since the connection comes from that device, the source address becomes its address. The real client address is carried in a header; this profile says in which situation that header will be taken into account.

Command Summary

TR7 WEB-CLI · lb trusted-proxy

# Tab after the command

admin@TR7LBWAF01> lb trusted-proxy

add delete list show update

 

admin@TR7LBWAF01> lb trusted-proxy list # list all of them

admin@TR7LBWAF01> lb trusted-proxy show <id> # show one

admin@TR7LBWAF01> lb trusted-proxy add name <name> … # new profile

admin@TR7LBWAF01> lb trusted-proxy update id <id> … # change

admin@TR7LBWAF01> lb trusted-proxy delete <id> # delete

admin@TR7LBWAF01>  

Required Fields

Order	Field	Status	Value
1	name	Required	The name of the profile; it must be unique in the collection

The Source Definitions

Every source defines together from where the real address will be read and which networks will be trusted. The sources are written with their own indexes.

Field	What it does	What is written after it
--sources.N.type	Selects from where the real address will be taken	xffLast the last address in the X-Forwarded-For header · xffFirst the first address · customHeader another header
--sources.N.headerName	Determines the header from which the address will be read	The header name; it opens only when --sources.N.type customHeader is selected
--sources.N.trustedNetworks.M.ip	Determines in the requests coming from which network this source will be trusted	A network address; every network with its own index
--sources.N.trustedNetworks.M.cidr	Determines the mask length of the network	A CIDR value, for example 24

The header should not be trusted without a trusted network being given

The address header can be written by the client as well. The trusted network list makes the header be taken into account only in the requests coming from the known proxy servers.

Examples

TR7 WEB-CLI · A) With X-Forwarded-For

admin@TR7LBWAF01> lb trusted-proxy add name front-load-balancer \

--sources.0.type xffLast \

--sources.0.trustedNetworks.0.ip 10.0.1.0 --sources.0.trustedNetworks.0.cidr 24

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) A custom header and two sources

admin@TR7LBWAF01> lb trusted-proxy add name cdn-and-lb \

--sources.0.type customHeader --sources.0.headerName CF-Connecting-IP \

--sources.0.trustedNetworks.0.ip 198.51.100.0 --sources.0.trustedNetworks.0.cidr 24 \

--sources.1.type xffFirst \

--sources.1.trustedNetworks.0.ip 10.0.1.0 --sources.1.trustedNetworks.0.cidr 24

 

admin@TR7LBWAF01> lb service update id <vService> --trustedProxy <profile>

admin@TR7LBWAF01>  

Updating and Deleting

TR7 WEB-CLI · update and delete

admin@TR7LBWAF01> lb trusted-proxy update id <id> --sources.0.type xffFirst

admin@TR7LBWAF01> lb trusted-proxy update id <id> --sources.1.delete

admin@TR7LBWAF01> lb trusted-proxy delete <id>

admin@TR7LBWAF01>  

Things to Know

• A profile does not work on its own. The address reading comes into play when the profile is bound to a vService with the --trustedProxy field. This field is found only in the vServices of the HTTP type.
• More than one source can be defined. Separate sources are written for the traffic coming by different ways, such as a CDN and an internal load balancer.
• The header name is asked for only in the custom source. When xffLast or xffFirst is selected, the header is already X-Forwarded-For.
• The name is unique. A second profile with the same name cannot be created.