Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Bit of an nginx noob here. I'm trying to setup nginx to reverse proxy all web traffic to a locally running web server. Right now it works but it says the IP address of every logged in user is 127.0.0.1. I read some other posts that I need to set the proxy_set_header Host $host; correctly. I set this this, but users IPs are still 127.0.0.1. Can anyone tell by looking at my nginx.conf if I'm setting proxy_set_header Host $host; incorrectly? I think I need to set it in both server blocks, but I don't have a location block in the server that accepts traffic on port 80. Which is where I think it might be getting lost.

    server {
       listen 80;
       server_name www.myapp.com myapp.com;
       return 301 https://myapp.com$request_uri;
    }

    server {
       listen 443;
       server_name _;
       ssl on;
       ssl_certificate /web/ssl/cert.pem;
       ssl_certificate_key /web/ssl/key.pem;

      location / {
         proxy_set_header Host $host;
         proxy_set_header  X-Real-IP  $remote_addr;
         proxy_pass http://localhost:8000;
       }

       location /robots.txt {
         alias /web/static/robots.txt;
      }

      }
share|improve this question
    
Is your application actually looking for the IP address in the X-Real-IP header? –  Michael Hampton Jul 15 at 19:58

2 Answers 2

Use;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

This will add a new header to the backend server which your application will be able to see the original IP addresses.

You're along the right lines with X-Real-IP, in that this will do the same thing (providing that $remote_addr is actually the client's IP address). X-Forwarded-For is more universal though, and if your backend is running a standard off-the-shelf package, it may already know about it. Likewise, if your application isn't looking at X-Real-IP header, then it won't reflect.

Putting it bluntly, there's no way to override the Remote-Addr header at the backend, as this is set internally by most all web servers. You need to get your application to look in other headers if Remote-Addr is a local, private, or otherwise unrouteable IP address (127.0.0.1, 10.x.x.x, etc).

share|improve this answer
    
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; causes nginx to fail on restart for me –  The Internet Jul 15 at 21:36
    
Oh, I forgot the semicolon. Still no dice though :( –  The Internet Jul 15 at 21:44
    
More context on your backend setup is required at this point tbh. The configuration works and will pass the relevant information to the backend server. It's now up to how your application is perceiving the user, and whether it's even able to look at the correct headers (or if you're able to change the application's code to get the IP address from an alternate header variable. –  dannosaur Jul 16 at 7:33

You could check if the backend server software has any tools to take the IP address from X-Forwarded-For or X-Real-IP headers and set it as the remote address. It all depends on your backend server software or application.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.