If you run nginx behind a CDN, you will by default see the proxy/CDN IP instead of the real client.

Edit the global http { part of nginx.conf and add this:

# 1. Specify the IP address of your trusted proxy/load balancer
set_real_ip_from  1.2.3.4; 

set_real_ip_from  5.2.3.4; 

# 2. Specify which header contains the real client IP
real_ip_header    X-Forwarded-For;

# 3. Optional: Use 'real_ip_recursive' if you have multiple proxies
real_ip_recursive on;
 

In #1 you can of course specify multiple IP lines and even ranges.

Now you'll see in access.log that you get the real client IPs.

nginx, ip, cdnif, cdn, default, proxy, edit, global, http, conf, specify, balancer, set_real_ip_from, header, contains, real_ip_header, forwarded, optional, real_ip_recursive, multiple, proxies, ranges, ll, ips,

Latest Articles