如何确定 http 请求是向内部网络还是向互联网发出？
我正在尝试编写一个代理服务器来记录和调整来自 IIS 场上托管的站点的流量。托管指南说：
添加或配置您的代理服务器 允许来自 Web 服务器的请求 互联网资源。请确保您 记录来自 Web 服务器的请求。 ·
仅允许网络服务器进行 代理请求到互联网，而不是 内部网络。所以，如果 请求的目的地是 互联网，应该允许它去 通过代理。但如果应用 正在尝试请求资源或 内网服务器， 应该预防。
我正在使用 FiddlerCore（驱动 Fiddler 的库），它允许我在发送请求之前检查请求，并在返回响应标头后再次检查（此时我拥有主机 IP）。
我该如何确定请求是在本地发出还是向互联网发出？目前我正在将已知的内部 IP 列入黑名单，但这似乎不对。
I'm trying to write a proxy server for logging and shaping traffic from sites hosted on an IIS farm. The hosting guidelines say:
Add or configure your proxy server to
allow requests from the web servers to
internet resources. Be sure that you
log requests from the web servers. ·Only allow the web server to make
proxy requests to the internet, not to
the internal network. So, if the
destination of the request is the
internet, it should be allowed to go
through proxy. But if the application
is trying to request a resource or
server on the internal network, it
should be prevented.
I'm using FiddlerCore (the library that drives Fiddler) which lets me inspect requests before they are sent, and again once the response headers are returned (at which point I have the host IP).
What can I do to determine if a request is being made locally or to the internet? Currently I'm blacklisting known internal IPs, but it doesn't seem right.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
HTTP RFC 指定客户端必须指定 主机标头。因此，通过检查主机标头来确定主机是本地主机还是互联网主机。
如果您的客户端违反了该规定（未指定主机），您有权使用 400（错误请求）来删除/拒绝它们。 （最好测试一下是否有不遵守协议的）
The HTTP RFC specified that the client must specify the host header. Thus, determine if the host is local or internet by inspecting the host header.
If you have clients violating that (no host specified) you have the right to drop/deny them with 400 (Bad Request). (Better test if there are ones that do not follow protocol)
将内部 IP 列入黑名单有什么问题？通常，您只需将所有 RFC 1918 不可路由网络视为内部网络（10.0.0.0/8、172.16.0.0/12、192.168.0.0/16）并称其为良好。如果您实际上可以全面公开路由，那么同样适用，但将您的公开可路由网络添加到列表中。我错过了什么吗？
What's wrong with blacklisting internal IPs? Typically you'd just consider all the RFC 1918 non-routable networks to be internal (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and call it good. If you're actually publicly routable across the board, well, then the same applies but add your publicly routable network(s) to the list. Am I missing something?
一般来说，问题是确定哪些地址是“内部”地址，哪些是外部地址。 RFC1918 是一种可以做到这一点的机制，但 IE 使用不同的策略；请参阅 http://msdn.microsoft.com/en -us/library/bb250483(v=vs.85).aspx 了解有关 IE 如何执行此操作的更多信息。
The problem, generally, is deciding what addresses are "internal" and which are external. RFC1918 is one mechanism by which you can do that, but IE uses a different strategy; see http://msdn.microsoft.com/en-us/library/bb250483(v=vs.85).aspx for more on how IE does it.