/ip/reverse-proxy
reverse-proxy
Each rule forwards the HTTPS requests for one host name to an HTTP server. The reverse proxy accepts HTTPS connections on the port of the reverse-proxy service in /ip/service, selects the rule whose sni matches the...
ip/reverse-proxy
Conditions: !smips Type: Directory
每条规则将一个主机名的 HTTPS 请求转发到 HTTP 服务器。反向代理在 /ip/service 中 reverse-proxy 服务的端口上接受 HTTPS 连接，选择 sni 与客户端发送的服务器名称匹配的规则，使用该规则的证书终止 TLS，并将请求作为 HTTP 转发到 ip-address 和 port。仅当至少存在一条已启用的规则时，服务端口才会开放。概述和示例请参阅 反向代理。
| 标志 | 名称 | 描述 |
|---|---|---|
X | disabled | 规则已禁用。新规则创建时处于启用状态。 |
D | dynamic | 该规则由 RouterOS 为具有 use-https=yes 和 Web 界面的容器应用创建（参见 /app）。其 sni 是应用 URL 的主机名，其证书是在 /app/settings 中设置的证书。 |
| 参数 | 类型 | 描述 |
|---|---|---|
sni * | string | Host name the rule serves. It is compared with the server name (SNI) the client sends in the TLS handshake and must match it exactly; a wildcard such as *.example.com matches nothing. The router closes a connection whose server name matches no rule, and the rproxy log shows no matching rule for <name>. |
ip-address * | alt { ipv6: ip6Addr , ip: ipAddr } | 请求转发到的服务器的 IPv4 或 IPv6 地址。路由器从其自身地址发起连接，并将每个请求作为 HTTP/1.1 转发。它保留 Host 头，并添加包含客户端地址的 X-Forwarded-For 和 X-Real-Ip、X-Forwarded-Proto: https、X-Forwarded-Host 和 Forwarded。 |
port * | num | 服务器的 TCP 端口。路由器始终使用纯 HTTP 连接，即使端口为 443，因此服务器必须在此端口上接受 HTTP。 |
certificate | enum (none) | Certificate the router presents to clients of this rule, for example one issued for the sni host name. With none, the certificate of the reverse-proxy service in /ip/service is used. When that is also none, the TLS handshake fails, and the rproxy log shows certificate missing for rule <sni>. Default: none. |
vrf | enum |