本文共 4421 字，大约阅读时间需要 14 分钟。

环境设定

插件功能

api信息

[root@kong ~]# curl http://localhost:8001/apis{
  "total":2,"data":[{
  "created_at":1527303008505,"strip_uri":true,"id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","hosts":["userhost"],"name":"userapi","http_if_terminated":false,"https_only":false,"retries":5,"preserve_host":false,"upstream_connect_timeout":60000,"upstream_read_timeout":60000,"upstream_send_timeout":60000,"upstream_url":"http:\/\/192.168.163.117:9001\/"},{
  "created_at":1527303019963,"strip_uri":true,"id":"992b9c3b-889a-4c15-94b5-561ac9fb1cc9","hosts":["orghost"],"name":"orgapi","http_if_terminated":false,"https_only":false,"retries":5,"preserve_host":false,"upstream_connect_timeout":60000,"upstream_read_timeout":60000,"upstream_send_timeout":60000,"upstream_url":"http:\/\/192.168.163.117:9002\/"}]}[root@kong ~]#

设定ip-restriction插件

事前插件信息确认

[root@kong ~]# curl http://localhost:8001/plugins{
  "total":0,"data":[]}[root@kong ~]#

设定ip-restriction插件

[root@kong ~]# curl -X POST http://localhost:8001/apis/userapi/plugins \>      --data "name=ip-restriction"  \>      --data "config.blacklist=172.17.0.3/16"{
  "created_at":1527303305000,"config":{
  "blacklist":["172.17.0.3\/16"]},"id":"3341a3f8-1d87-4960-9da1-232718d2b89d","name":"ip-restriction","api_id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","enabled":true}[root@kong ~]#

设定后插件信息确认

[root@kong ~]# curl http://localhost:8001/plugins{
  "total":1,"data":[{
  "created_at":1527303305000,"config":{
  "blacklist":["172.17.0.3\/16"]},"id":"3341a3f8-1d87-4960-9da1-232718d2b89d","name":"ip-restriction","api_id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","enabled":true}]}[root@kong ~]#

blacklist确认

由于设定blacklist为172.17.0.3/16，所以IP为172.17.0.3和172.17.0.2的两个容器内都被限制了访问，从如下的容器中得到了确认

172.17.0.3被限制

[root@kong ~]# docker exec -it trusting_liskov sh/ # ip ad |grep 172    inet 172.17.0.3/16 scope global eth0/ # / # curl -H 'Host: userhost' http://192.168.163.117:8000{
  "message":"Your IP address is not allowed"}/ #

172.17.0.2被限制

[root@kong ~]# docker exec -it optimistic_stallman sh/ # ip ad |grep 172    inet 172.17.0.2/16 scope global eth0/ # / # curl -H 'Host: userhost' http://192.168.163.117:8000{
  "message":"Your IP address is not allowed"}/ #

192.168.163.117可正常访问

[root@kong ~]# curl -H 'Host: userhost' http://192.168.163.117:8000Hello, Service :User Service[root@kong ~]# ip ad |grep 192    inet 192.168.163.117/24 brd 192.168.163.255 scope global enp0s3[root@kong ~]#

转载地址：https://liumiaocn.blog.csdn.net/article/details/80488524 如侵犯您的版权，请留言回复原文章的地址，我们会给您删除此文章，给您带来不便请您谅解！