0

I'm running an nginx reverse proxy to be able to run multiple servers behind my firewall. I noticed on my (Kerio) mail server the error log is filled with "failed login from < local ip of nginx >" and I was wondering how can I set it so I get the remote IP of the person/bot that is trying to login so I might use that information for auto blocking those addresses (for example)?

This is my current config:

server {
    listen 8443 ssl http2;
    server_name mail.domain.com;

    location / {
        proxy_set_header Host $host;
        proxy_pass https://<internal ip>/;
        client_max_body_size 0;
        proxy_connect_timeout 3600;
        proxy_send_timeout 3600;
        proxy_read_timeout 3600;
        send_timeout 3600;
    }
}

Adding the following lines, results in more of the same:

proxy_set_header   X-Real-IP          $remote_addr;
proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
7
  • You already passed along the IP address. Whatever software you passed it to must now deal with it. – Michael Hampton Jun 16 at 20:07
  • Crap. So basically a no-go is what you're saying since my mailserver shows the local ip only? – vespino Jun 16 at 20:09
  • You didn't say what you are passing it to, but generally most software has some way of dealing with this. You should say what you are passing it to. – Michael Hampton Jun 16 at 20:10
  • Kerio mailserver is what I'm passing it to. – vespino Jun 16 at 20:11
  • I don't see anything relevant from a quick look through the manual. You should edit your question so that perhaps people familiar with Kerio will be alerted to its existence. – Michael Hampton Jun 16 at 20:19
0

X-Forwarded-For is the feature you need and this will add a http header containing the original client IP. From what you are saying the Kerio Application is ignoring this and just using the Source IP (which is the nginx) in the Logs. Perhaps there is an option to analyse and use this that can be configured on the application.

2
  • So what is the option? This post is useless without that information. – Michael Hampton Jun 16 at 20:55
  • Like you said there is nothing in the docs on how to configure this in Kerio. since the Q was in relation to the nginx config its worth calling out that this is correct as the forwarded for header is being added. – Barry Gleeson Jun 16 at 21:07
0

Just found out my mail server (Kerio) does nothing with the information forwarded by the reverse proxy, so the only thing I can do is hope for an update that does.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.