https://github.com/Pylons/waitress/pull/249 1.2.1 (2019-01-25) Bugfixes When given an IPv6 address in X-Forwarded-For or Forwarded for= waitress was placing the IP address in REMOTE_ADDR with brackets: [2001:db8::0] waitress-serve \ --listen "*:$PORT" \ --trusted-proxy '*' \ --trusted-proxy-headers 'x-forwarded-for x-forwarded-proto x- forwarded-port' \ --log-untrusted-proxy-headers \ --clear-untrusted-proxy-headers environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header

https://github.com/Pylons/waitress/pull/249 1.2.1 (2019-01-25) Bugfixes When given an IPv6 address in X-Forwarded-For or Forwarded for= waitress was placing the IP address in REMOTE_ADDR with brackets: [2001:db8::0] waitress-serve \ --listen "*:$PORT" \ --trusted-proxy '*' \ --trusted-proxy-headers 'x-forwarded-for x-forwarded-proto x- forwarded-port' \ --log-untrusted-proxy-headers \ --clear-untrusted-proxy-headers environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header

https://github.com/Pylons/waitress/pull/249 1.2.1 (2019-01-25) Bugfixes When given an IPv6 address in X-Forwarded-For or Forwarded for= waitress was placing the IP address in REMOTE_ADDR with brackets: [2001:db8::0] waitress-serve \ --listen "*:$PORT" \ --trusted-proxy '*' \ --trusted-proxy-headers 'x-forwarded-for x-forwarded-proto x- forwarded-port' \ --log-untrusted-proxy-headers \ --clear-untrusted-proxy-headers environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header

web: waitress-serve \ --listen "*:$PORT" \ --trusted-proxy '*' \ --trusted-proxy-headers 'x-forwarded-for x-forwarded-proto x-forwarded-port' \ --log-untrusted-proxy-headers \ --clear-untrusted-proxy-headers environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port $server_port; when using Apache, mod_proxy automatically forwards the following headers: X-Forwarded-For X-Forwarded-Host X-Forwarded-Server You will also want to add to Apache: RequestHeader set

web: waitress-serve \ --listen "*:$PORT" \ --trusted-proxy '*' \ --trusted-proxy-headers 'x-forwarded-for x-forwarded-proto x-forwarded-port' \ --log-untrusted-proxy-headers \ --clear-untrusted-proxy-headers environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port $server_port; when using Apache, mod_proxy automatically forwards the following headers: X-Forwarded-For X-Forwarded-Host X-Forwarded-Server You will also want to add to Apache: RequestHeader set

web: waitress-serve \ --listen "*:$PORT" \ --trusted-proxy '*' \ --trusted-proxy-headers 'x-forwarded-for x-forwarded-proto x-forwarded-port' \ --log-untrusted-proxy-headers \ --clear-untrusted-proxy-headers environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port $server_port; when using Apache, mod_proxy automatically forwards the following headers: X-Forwarded-For X-Forwarded-Host X-Forwarded-Server You will also want to add to Apache: RequestHeader set

https://github.com/Pylons/waitress/pull/249 1.2.1 (2019-01-25) Bugfixes When given an IPv6 address in X-Forwarded-For or Forwarded for= waitress was placing the IP address in REMOTE_ADDR with brackets: [2001:db8::0] environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port $server_port; when using Apache, mod_proxy automatically forwards the following headers: X-Forwarded-For X-Forwarded-Host X-Forwarded-Server You will also want to add to Apache: RequestHeader set

environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port $server_port; when using Apache, mod_proxy automatically forwards the following headers: X-Forwarded-For X-Forwarded-Host X-Forwarded-Server 1.3. Using Behind a Reverse Proxy 7 waitress Documentation https Configure waitress’s trusted_proxy_headers as appropriate: trusted_proxy_headers = "x-forwarded-for x-forwarded-host x-forwarded-proto x- ˓→forwarded-port" At this point waitress will set up

environment using X-Forwarded-Proto, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Port: proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port $server_port; when using Apache, mod_proxy automatically forwards the following headers: X-Forwarded-For X-Forwarded-Host X-Forwarded-Server 1.3. Using Behind a Reverse Proxy 7 waitress Documentation https Configure waitress’s trusted_proxy_headers as appropriate: trusted_proxy_headers = "x-forwarded-for x-forwarded-host x-forwarded-proto x- ˓→forwarded-port" At this point waitress will set up

connections  L4 • Add IP in TCP Protocol options • Proxy Protocol  L7 • HTTP header “x-forwarded-for” • User Protocol #IstioCon LVS ① user send traffic to LVS ② PREROUTING chain intercept which of the two versions is present. - Proxy Protocol Transport Socket #IstioCon HTTP XFF x-forwarded-for (XFF) is a standard proxy header which indicates the IP addresses that a request has flowed Pod2：10.244.0.25 Dest: 127.0.0.1 Src：127.0.0.1 XFF: 10.244.0.20 XFF: 10.244.0.20 ① Enable X-Forwarded-For HTTP header in svcA #IstioCon Preserve HTTP Original Src Addr - ingress svcB envoy envoy