Files
felhom.eu/documentation/audits/lockouts-2026-10-01/tools/echo.sh
T

12 lines
1.1 KiB
Bash

set -e
docker rm -f echo-probe cf-sim >/dev/null 2>&1 || true
docker run -d --name echo-probe --network traefik-public \
-l traefik.enable=true -l 'traefik.http.routers.echo-probe.rule=Host(`echo-probe.enkisfelhom.hu`)' \
-l traefik.http.routers.echo-probe.entrypoints=websecure -l traefik.http.routers.echo-probe.tls=true \
-l traefik.http.services.echo-probe.loadbalancer.server.port=80 traefik/whoami:v1.11 >/dev/null
sleep 5
echo "traefik ip: $(docker inspect traefik --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}') echo ip: $(docker inspect echo-probe --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')"
echo "## T: the tunnel's hop simulated — a container on traefik-public (where cloudflared sits) sending what cloudflared sends"
docker run --rm --name cf-sim --network traefik-public curlimages/curl:8.11.1 -sk https://traefik/ -H 'Host: echo-probe.enkisfelhom.hu' \
-H 'X-Forwarded-For: 6.6.6.6, 203.0.113.9' -H 'CF-Connecting-IP: 203.0.113.9' -H 'X-Forwarded-Proto: https' | grep -iE '^(RemoteAddr|X-Forwarded-For|X-Real-Ip|Cf-Connecting-Ip|IP: 172)'