| tenant-type | | slug | client-ip-whitelist-f5-obclient |
When accessing an OceanBase tenant using a load balancer such as F5, whether the tenant can connect is often related to the "client IP" used by the OBServer for allowlist verification. This topic describes the behavior differences between obclient V1.x and V2.2.x, and whether ip_white_list should be set to the F5 backend VIP or the client's actual IP.
The working principle of the OceanBase tenant allowlist is as follows: The OBServer reads the client IP-related attributes in the Connection Attributes of the connection (commonly client_ip; in packet capture, it may also appear as __client_ip or similar, subject to the actual protocol and version), and determines whether this address exists in the tenant's **ip_white_list. If it matches an entry in the allowlist, the connection is allowed; otherwise, it is denied, typically with an Access denied response.
In obclient V1.x, the driver cannot pass through the client's actual IP to the server. In a typical F5 access scenario, F5 may not present the real client IP in a format usable by the OBServer; therefore, the allowlist check is based more closely on the virtual IP pool (VIP) of the F5 backend. Thus, in a V1.x client environment, the tenant allowlist generally needs to be configured with the VIP pool of the F5 backend.
Starting from obclient V2.2.x, the driver begins to support passing through the client IP, writing the address of the client's machine into the client_ip connection attribute (which may appear as an alias like __client_ip in packet capture). When the OBServer reads this attribute and finds a value, it uses that value as the basis, rather than continuing to use the F5 peer VIP as the final client identity for allowlist verification. Therefore, when the client has been upgraded to V2.2.x or later and the link is as expected, the tenant allowlist is better configured with the client's actual IP (or corresponding IP range), rather than just configuring the VIP pool.
Note
The key names in connection attributes may vary slightly between different OceanBase versions and clients (including libobclient / Connector/C, etc.); the allowlist always refers to the connection attributes actually parsed by the OBServer.
Notice
Before deciding whether to write the VIP or the real client IP to the allowlist, please verify the actual client version and the link (whether it goes through F5, if there are other proxies, etc.). When using multiple access methods together, the allowlist must cover all legitimate source address forms that can still reach the tenant.