Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

the server IP of mine is ***.***.***.234. For SSL, I needed to add another IP ***.***.***.235. This is a vps and the IP address was added by a friend.

The problem is: when someone submit comments (WordPress), the user IP is detected as ***.***.***.235, which is the server ip, not the users and thats really a problem. How this can be solved?

The VPS is running on Cent OS and Nginx.

Update: VHOST entry

server {
     error_log /var/log/nginx/vhost-error_log warn;
     listen ***.***.***.235:80;
     server_name example.com www.example.com;
     access_log /usr/local/apache/domlogs/example.com-bytes_log bytes_log;
     access_log /usr/local/apache/domlogs/example.com combined;
     root /home/tareq/public_html;

     location / {
          location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$ {
               expires 1d;
               try_files $uri @backend;
          }

          error_page 405 = @backend;
          add_header X-Cache "HIT from Backend";
          proxy_pass http://***.***.***.235:8081;
          include proxy.inc;
     }

     location @backend {
          internal;
          proxy_pass http://***.***.***.235:8081;
          include proxy.inc;
     }

     location ~ .*\.(php|jsp|cgi|pl|py)?$ {
          proxy_pass http://***.***.***.235:8081;
          include proxy.inc;
     }

     location ~ /\.ht {
          deny all;
     }
}
share|improve this question
    
What software is acting as the SSL endpoint? –  David Schwartz Aug 19 '13 at 20:40
    
And what do you have running on port 8081? –  Michael Hampton Aug 20 '13 at 0:34
    
@MichaelHampton, visiting 8081 port I am also seeing the site homepage. –  Tareq Aug 20 '13 at 8:24
    
Didn't you set this up? If you don't even know what you have running on your server, you should probably find out, first. –  Michael Hampton Aug 20 '13 at 13:34

1 Answer 1

Sounds like nginx is not configured to pass client address to Apache.
You will want to alter your nginx configuration file(s) to include the following:

server{
    location / {
        proxy_pass http://127.0.0.1:PORT;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

The final step is to install mod_rpaf for Apache. This module allows you to set the value of the remote address when using a proxy. If you haven’t already got the module installed (try “a2enmod rpaf” to find out), you can install it via apt-get:

sudo apt-get install libapache2-mod-rpaf

Although you may be retrieving the correct IP addresses now, you’ll want to ensure the module is configured correctly. My Apache configuration file has the following code just below all my other ’s:

# The following lines allow client IP to be passed from Nginx to Apache
<IfModule mod_rpaf.c>
    RPAFenable On
    RPAFsethostname On
    RPAFproxy_ips 127.0.0.1
</IfModule>
share|improve this answer
    
He said he was running nginx, not apache. –  Michael Hampton Aug 19 '13 at 23:24
    
Yes, it's nginx, not apache. I've updated with my vhost entry –  Tareq Aug 20 '13 at 0:32
    
True, but where is he sending his dynamic content on port 8081? –  AngryWombat Aug 21 '13 at 2:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.