I'm configuring nginx as a reverse proxy in front of Tomcat 7. I added the following lines to nginx configuration:

location / {
    proxy_pass http://tomcat;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

But still, I see in Tomcat logs the following picture: - - [10/Jun/2013:11:25:48 +0600] "GET /app/welcome;jsessionid=6C1B02376C5F748C509B28FC7CE416C9 HTTP/1.0" 200 10571 - - [10/Jun/2013:11:25:48 +0600] "GET /app/welcome;jsessionid=0BBE0174C1F0E94FDF49610144E809D3 HTTP/1.0" 200 10571 - - [10/Jun/2013:11:25:48 +0600] "GET /app/welcome;jsessionid=AD48005AD453F3A0BE46F1AC978F145D HTTP/1.0" 200 10571

Is there any way to force Tomcat to use X-Real-IP header (and write it to log files) without modifying web app?


It's required to add Valve in Tomcat configuration:

<Valve className="org.apache.catalina.valves.RemoteIpValve"
               internalProxies="127\.0\.0\.1"  />

After that Tomcat starts to dispatch headers passed from nginx:

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  • 4
    As per the documentation, internalProxies is expecting a regular expression, not a string literal. As such, should please be 127\.0\.0\.1. – ziesemer Dec 10 '15 at 17:49

Found this question via google, and want to add comment to the approved answer:

According to documentation, by default this valve (RemoteIpValve) has no effect on the values that are written into access log. In order to get real IPs in log, you should add


to AccessLogValve also.


I was searching for the same thing and found information leading me to the following solution from researching around the net.

In your tomcat server.xml you need to edit the logging valve pattern to get the values from the incoming header.

In your

and change the pattern to:

pattern="Remote User[ %{X-Forwarded-For}i %l %u %t ] Request[ &quot;%r&quot; ] Status Code[ %s ] Bytes[ %b ] Referer[ &quot;%{Referer}i&quot; ] Agent[ &quot;%{User-agent}i&quot; ] "

My full access log value looks like the following:

      <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="access_log." suffix=".txt"
               pattern="Remote User[ %{X-Forwarded-For}i %l %u %t ] Request[ &quot;%r&quot; ] 
               Status Code[ %s ] Bytes[ %b ] Referer[ &quot;%{Referer}i&quot; ] 
               Agent[ &quot;%{User-agent}i&quot; ] " />

This is accompanied by the Nginx config of:

location / {
    proxy_pass http://localhost:8080;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_intercept_errors on;

Additional information of log valve patterns in Tomcat can be found at: Apache 7: The Valve Component


You'll need to install mod_realip http://httpd.apache.org/docs/trunk/mod/mod_remoteip.html (http://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#Remote_IP_Filter) or mod_rpaf at the apache server.


Another useful example of Tomcat config: internalProxies can be separated with pipeline (|) since accepts regular expression.


For more examples refer to tomcat document

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.