Description
I host my own wish server behind a relay server that exposes the wish app to the internet. The backend server does not know what IP addresses the clients are coming from because it only can see the source IP of the relay server. This makes it difficult to do things like rate limiting. Since the relay server is not breaking the SSH connection, it doesn't know what's happening, so I can't rate limit there either.
In 2011 the people working on HA Proxy developed what would be known as the PROXY protocol. This solved the problem of how upstream load balancers and proxies could pass information about the original client's IP address and port to the backend server.
In order to take advantage of the PROXY protocol, the load balancer must send the PROXY header and the backend server needs to be able to read the header. The protocol is supported by a wide variety of load balancers including:
HA Proxy
nginx
Amazon Application Load Balancers
Traefik
Envoy
Cloudflare
I've prepared a PR for this already and submitted it to the upstream https://github.com/gliderlabs/ssh. Unfortunately, it looks like that project is largely abandoned. I was ready to submit the PR for this repo, but the contributing.md says I should open a discussion first.
Description
I host my own wish server behind a relay server that exposes the wish app to the internet. The backend server does not know what IP addresses the clients are coming from because it only can see the source IP of the relay server. This makes it difficult to do things like rate limiting. Since the relay server is not breaking the SSH connection, it doesn't know what's happening, so I can't rate limit there either.
In 2011 the people working on HA Proxy developed what would be known as the PROXY protocol. This solved the problem of how upstream load balancers and proxies could pass information about the original client's IP address and port to the backend server.
In order to take advantage of the PROXY protocol, the load balancer must send the PROXY header and the backend server needs to be able to read the header. The protocol is supported by a wide variety of load balancers including:
HA Proxy
nginx
Amazon Application Load Balancers
Traefik
Envoy
Cloudflare
I've prepared a PR for this already and submitted it to the upstream https://github.com/gliderlabs/ssh. Unfortunately, it looks like that project is largely abandoned. I was ready to submit the PR for this repo, but the contributing.md says I should open a discussion first.