Nginx's real_ip module allows you to set the
$remote_addr variable based on values sent in particular header fields. It has a special understanding of the
X-Forwarded-For header, and is able to use the right-most untrusted value in the header as the connecting IP address.
I'd like to use the real_ip module to set
$remote_addr to the connecting IP address. The problem I have is that I know how many hops back from the end of the
X-Forwarded-For to look at, but not the IP address of the proxies in between. As I understand it, that means that I can't use
set_real_ip_from to specify the proxy's IP address.
What I would like to be able to do is to configure nginx to choose the second to last address in the list as the
$remote_addr. It seems as if the real_ip module only works if you have infrastructure where you know the IP addresses of your proxies.
Is there a way to do this with the real_ip module? I've worked up a regex based solution, but I would prefer to use the real_ip module if it is possible.
I don't think this is a dupe of nginx real_ip_header and X-Forwarded-For seems wrong or similar questions. To restate the issue:
- I know how many hops from the end the connecting IP address will be.
- I don't know the trusted IP addresses for intermediary proxies between the connecting IP and my server, so I can't use
More details on the specifics:
I am running nginx inside Google Cloud, behind the Google Cloud HTTP Load Balancer. Google Cloud uses the
X-Forwarded-For header to indicate the entry point to Google Cloud's network. I know that the second to last value in the
X-Forwarded-For list is the one that I want, but I don't know what the IP address of the last value (the proxy) will be. Even if I could enumerate all of Google Cloud's address space for proxies (it's not specified that GCLB only operates inside GCP's address space), that would open it up for any other users that can get a server inside that address space.