-
Notifications
You must be signed in to change notification settings - Fork 7.7k
Description
Describe the feature you'd like to add to nginx
Add transparent parameter support for the HTTP module's listen directive, similar to the existing implementation in the stream module.
Proposed syntax:
http {
server {
listen 80 transparent;
listen [::]:80 transparent;
location / {
proxy_bind $remote_addr transparent;
proxy_pass http://$host;
}
}
}Describe the problem this feature solves
Currently, deploying nginx as a transparent HTTP proxy or Web Application Firewall (WAF) in bridge mode is not possible because the HTTP listen directive lacks transparent support.
The deployment scenario:
Client → [iptables TPROXY] → nginx → upstream/origin server
Additional context
I have reviewed the nginx source code and found that implementing this feature is straightforward, as most of the infrastructure already exists:
1,NGX_HAVE_TRANSPARENT_PROXY feature detection is already in place ( auto/unix )
2,IP_TRANSPARENT / IP_BINDANY / SO_BINDANY socket options are already used in ngx_event_connect.c
3,proxy_bind transparent is already supported in the HTTP upstream module
4,The stream module's implementation can serve as a reference
Final
I have implemented this feature in our internal fork and would be happy to contribute a patch if the nginx team is interested. Please let me know if there are any design considerations or concerns I should be aware of.