適用於App Engine或其他雲環境的入站靜態固定IP地址代理

Question

App Engine和其他一些雲平臺正在使用各種各樣的IP地址，這對於那些有防火牆限制的人來說很棘手。

我們有客戶誰想要使用我們的服務，但他們只能發送請求到已知的IP地址。

如何爲http/https轉發到雲服務設置固定的IP地址代理？

Answer 1

以下是關於如何爲您的雲服務編寫入站代理的簡單配方。

要求：訪問具有固定IP並且安裝了Node.js的機器。

下面的節點腳本是你所需要的

1）剪切並粘貼到一個文件並執行

2）改變 「my.server.com」

3）變更SSL證書路徑，如何創建下面

var 
    fs = require('fs'), 
    url = require('url'), 
    http = require('http'), 
    https = require('https'); 

var https_options = { 
    key: fs.readFileSync('/path/ssl_certificate/key.pem'), 
    cert: fs.readFileSync('/path/ssl_certificate/cert.pem') 
}; 

function http_forward(request, response) { 
    'use strict'; 
    var 
     target_host_options = {}, 
     target_url_obj = url.parse('https://my.server.com' + request.url), 
     target_host_obj = https, 
     target_host_request; 

    target_host_options.hostname = target_url_obj.hostname; 
    target_host_options.path = target_url_obj.path || '/'; 

    if (target_url_obj.auth) { 
     target_host_options.path = target_url_obj.auth; 
    } 

    target_host_options.agent = false; //Disable socket pooling 
    target_host_options.method = request.method; 
    target_host_options.headers = request.headers; 
    delete target_host_options.headers.host; //Necessary 
    target_host_options.headers['X-Proxy-Client-Ip'] = request.connection.remoteAddress; 


    target_host_request = target_host_obj.request(target_host_options, function (target_host_response) { 
     target_host_response.resume(); 

     response.writeHead(target_host_response.statusCode, target_host_response.headers); 
     target_host_response.pipe(response); 
    }); 

    target_host_request.on('error', function (err) { 
     response.writeHead(400, {'Content-Type': 'text/plain'}); 
     response.write('PROXY target_host_request error\n'); 
     response.write(JSON.stringify(err)); 
     response.end(); 
    }); 


    request.pipe(target_host_request); 
} 

http.createServer(http_forward).listen(8080); 
https.createServer(https_options, http_forward).listen(8443); 
console.log('Inbound_proxy ..starting...'); 

他們，如果你沒有一個SSL證書指令：下面你使用Linux/Ubuntu的

如何創建一個

$ openssl genrsa -out key.pem 
$ openssl req -new -key key.pem -out csr.pem 
$ openssl x509 -req -days 9999 -in csr.pem -signkey key.pem -out cert.pem 
$ rm csr.pem