client-request-with-multiple-x-forwarded-for-headers.go

package main

import (
	"crypto/tls"
	"fmt"
	"net"
	"time"

	"io/ioutil"
	"log"
	"net/http"
	"net/http/httptest"
	"net/http/httputil"
	"net/url"
)

func main() {

	rpURL, err := url.Parse("https://35.x.x.x/")
	if err != nil {
		log.Fatal(err)
	}

	director := func(req *http.Request) {
		req.URL.Scheme = rpURL.Scheme
		req.URL.Host = rpURL.Host
	}

	transport := &http.Transport{
		Proxy: http.ProxyFromEnvironment,
		Dial: (&net.Dialer{
			Timeout:   30 * time.Second,
			KeepAlive: 30 * time.Second,
		}).Dial,
		TLSHandshakeTimeout: 10 * time.Second,
		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true},
	}

	reverseProxy := httptest.NewServer(&httputil.ReverseProxy{Director: director, Transport: transport})
	defer reverseProxy.Close()

	client := &http.Client{}
	r, _ := http.NewRequest(http.MethodGet, reverseProxy.URL, nil)
	sum := "127.0.0.1"
	for i := 0; i < 5; i++ {
		sum += "," + sum
	}
	r.Header.Add("X-Forwarded-For", sum)
	resp, _ := client.Do(r)
	fmt.Println(resp.Status)

	b, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}

	fmt.Printf("%s", b)
}

client-request-with-x-forwarded-for-header.go

package main

import (
	"crypto/tls"
	"fmt"
	"net"
	"time"

	"io/ioutil"
	"log"
	"net/http"
	"net/http/httptest"
	"net/http/httputil"
	"net/url"
)

func main() {

	rpURL, err := url.Parse("https://35.x.x.x/")
	if err != nil {
		log.Fatal(err)
	}

	director := func(req *http.Request) {
		req.URL.Scheme = rpURL.Scheme
		req.URL.Host = rpURL.Host
	}

	transport := &http.Transport{
		Proxy: http.ProxyFromEnvironment,
		Dial: (&net.Dialer{
			Timeout:   30 * time.Second,
			KeepAlive: 30 * time.Second,
		}).Dial,
		TLSHandshakeTimeout: 10 * time.Second,
		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true},
	}

	reverseProxy := httptest.NewServer(&httputil.ReverseProxy{Director: director, Transport: transport})
	defer reverseProxy.Close()

	resp, err := http.Get(reverseProxy.URL)
	if err != nil {
		log.Fatal(err)
	}

	b, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}

	fmt.Printf("%s", b)
}

Value: https://35.x.x.x/ has to be replaced with ingress external IP.