Docker compose 搭建的测试环境下，没办法拿到真实的 Client IP 吗？

[kenshin912]

有一台阿里云的服务器，我用 docker compose 起了一套测试环境，需要获取用户真实 IP，Google 了挺久一直没解决，所以跑 V2EX 来问问大佬们。

Web Server 是 Openresty，后端是 PHP

docker-compose 文件部分如下：

version: '3.8'

services:
    openresty:
        image: ${OPENRESTY_IMAGE}
        container_name: openresty
        build:
            context: ./service/openresty
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ${SOURCE_DIR}:/home/wwwroot/:rw
            - ${OPENRESTY_SSL_DIR}:/etc/nginx/ssl:rw
            - ${OPENRESTY_CONF_DIR}:/etc/nginx/conf.d/:rw
            - ${OPENRESTY_CONF_FILE}:/usr/local/openresty/nginx/conf/nginx.conf:ro
            - ${OPENRESTY_LUA_DIR}:/usr/local/openresty/nginx/lua/:rw
            - ${OPENRESTY_LOG_DIR}:/home/wwwlogs/openresty/:rw
        restart: always
        networks:
            - frontend
        depends_on:
            - php
  php:
        image: ${PHP_IMAGE}
        container_name: php
        build:
            context: ./service/php
        volumes:
            - ${SOURCE_DIR}:/home/wwwroot/:rw
            - ${PHP_LOG_DIR}:/var/log/php
            - ${DATA_DIR}/composer:/tmp/composer
            #- ${PHP_CONF_FILE}:/usr/local/etc/php/php.ini
            #- ${PHP_FPM_CONF_FILE}:/usr/local/etc/php-fpm.d/www.conf
            #- ${SUPERVISOR_CONF_FILE}:/etc/supervisord.conf
            #- ${SUPERVISOR_CONF_DIR}:/etc/supervisor/conf.d
        restart: always
        networks:
            - frontend
            - backend
        depends_on:
            - mysql

遇到的情况就是，不管是 Openresty 的 log , 还是程序打印出来的 $_SERVER['REMOTE_ADDR'] 都是 docker 网关的地址，拿不到真实的用户 IP，就很尴尬...

有没有大佬能提点一下，谢谢啦

[kenshin912]

@shynome #15
@muzuiget #17
@privil #19

感谢各位的帮助，问题已经解决。
参考链接:
https://stackoverflow.com/questions/47537954/how-to-make-docker-container-see-real-user-ip
https://stackoverflow.com/a/61263768

首先将 openresty 所在 network 对应的网卡接口调整到 internal 区域
执行完这个命令后重启防火墙, 访问 openresty 会报 no route to host 的错误
接着执行后三条命令即可。

firewall-cmd --zone=internal --change-interface=br-e9d63ecbe9c7 --permanent
firewall-cmd --reload
sysctl net.bridge.bridge-nf-call-iptables=0
sysctl net.bridge.bridge-nf-call-arptables=0
sysctl net.bridge.bridge-nf-call-ip6tables=0