0. 前言

2022年底，本站正式迁移至国产平台龙芯3A5000。
但由于家用宽带禁止开启80/443端口，需要一台公网VPS做反向代理。
同时，为了防止垃圾评论信息，需要获取访客的真实IP以建立黑名单。

整体架构：
公网VPS → Nginx → frps → 内网服务器 → frpc → Nginx → WordPress (php)

1. 公网VPS配置

nginx

在vhost的配置文件中添加：

location / {
    proxy_pass https://127.0.0.1:<frpc监听端口>/;
    proxy_redirect off;

    proxy_set_header Host host;
    proxy_set_header X-Real-IPremote_addr;
    proxy_set_header X-Forwarded-Host server_name;
    proxy_set_header X-Forwarded-Forproxy_add_x_forwarded_for;
}

frps

[common]
bind_port = <frps监听端口>

tcp_mux = true
tls_enable = true
tls_only = true

authentication_method = token
token = <token>

# trace, debug, info, warn, error
log_level = info
log_max_days = 3
log_file = /etc/frp/frps.log

2. 内网服务器配置

nginx

将vhost中的server设置为：

listen <frpc监听端口> ssl http2 proxy_protocol;

并添加：

real_ip_header proxy_protocol;
real_ip_recursive on;
set_real_ip_from 127.0.0.1;

frpc

[common]
server_addr = <frps公网ip>
server_port = <frps监听端口>

tcp_mux = true
tls_enable = true

authentication_method = token
token = <token>

# trace, debug, info, warn, error
log_level = debug
log_max_days = 3
log_file = /etc/frp/frpc.log

[katyusha.net]
type = tcp
local_ip = 127.0.0.1
local_port = <frpc监听端口>
remote_port = <frpc监听端口>
proxy_protocol_version = v2

3. WordPress 获取反代后的真实ip

在wp-config.php文件末尾添加：

/*获取反代后的真实IP*/
if ( !empty( _SERVER[_!_!_039;HTTP_CLIENT_IP_!_!_039;] ) ) { //check ip from share internetip = _SERVER[_!_!_039;HTTP_CLIENT_IP_!_!_039;];
} elseif ( !empty(_SERVER[_!_!_039;HTTP_X_REAL_IP_!_!_039;] ) ) {
    ip =_SERVER[_!_!_039;HTTP_X_REAL_IP_!_!_039;];
} elseif ( !empty( _SERVER[_!_!_039;HTTP_X_FORWARDED_FOR_!_!_039;] ) ) {ip = _SERVER[_!_!_039;HTTP_X_FORWARDED_FOR_!_!_039;];
} else {ip = _SERVER[_!_!_039;REMOTE_ADDR_!_!_039;];
}_SERVER[_!_!_039;REMOTE_ADDR_!_!_039;] = $ip; // set ip via complex method because remote_addr could have proxy ip

/*设置服务端真实端口*/
#define( _!_!_039;JETPACK_SIGNATURE__HTTPS_PORT_!_!_039;, <frpc监听端口> )

4. 测试

可创建一个php文件，用于测试是否能获取到真实ip

<p>REMOTE_ADDR: <?php function get_REMOTE_ADDR(){
    return @_SERVER["REMOTE_ADDR"];
}
echo get_REMOTE_ADDR();
?></p>
<br/>
<p>HTTP_X_REAL_IP: <?php function get_HTTP_X_REAL_IP(){
    return @_SERVER["HTTP_X_REAL_IP"];
}
echo get_HTTP_X_REAL_IP();
?></p>
<br/>
<p>HTTP_X_FORWARDED_FOR: <?php function get_HTTP_X_FORWARDED_FOR(){
    return @_SERVER["HTTP_X_FORWARDED_FOR"];
}
echo get_HTTP_X_FORWARDED_FOR();
?></p>
<br/>
<p>HTTP_CLIENT_IP: <?php function get_HTTP_CLIENT_IP(){
    return @_SERVER["HTTP_CLIENT_IP"];
}
echo get_HTTP_CLIENT_IP();
?></p>