6

I am running Nginx in a Docker container as a reverse proxy using the configuration below. It basically redirects the request to another docker container running on the same machine

Problem

The problem is that the output in the access log states the wrong client IP address, specifically I get the IP of the Docker host 172.17.0.1:

172.17.0.1 - - [24/May/2016:19:50:18 +0000] "GET /admin/ HTTP/1.1" 200 19243 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0" "-"

I tried to follow the advice from this post regarding the set_real_ip_from directive but without any success.

Configuration

server {
    listen       8000 ssl;
    server_name  example.com;

    access_log  /var/log/nginx/host.access.log  main;

    ssl_certificate     /path/to/cert.pem;
    ssl_certificate_key /path/to/key.key;

    set_real_ip_from 172.17.0.1;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    proxy_set_header    Host $host:$server_port;
    proxy_set_header    X-Real-IP $remote_addr;
    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto $scheme;

    location / {
        proxy_pass  http://172.17.0.1:8100/;
    }
}

What am I missing here?


Edit:

I just realised that other people have a similar problem here and here but unfortunately no solution.

0

You need to set the X-Forwarded-For header (not X-Real-IP, that's even less standard) on the machine doing the proxying, and you need to tell whatever's receiving the request to trust that the XFF header is legit because it's coming from a known IP. The config you've got in your question is only for one machine, but it's got the config you need for both ends.

| improve this answer | |
  • Thank you for your reply. I understand that both machines have to be configured but the log entry I posted above is from the proxying machine / docker container. So already that one does not get the proper IP address of the request but instead logs the IP of the docker host. – mincos May 26 '16 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.