How to get the real IP address in the clients

[Waldorf3]

So my setup is as follows.

I have a Proxmox server with a number of virtual machines.

All virtual macines are interconnected with private IP addresses (like 10.10.10.x, with x essentially being the VMID)

One virtual machine additionally has a public ip address. It runs nginx-proxy-manager in docker, and receives the traffic on the public IP address, and forwards the traffice to the other virtual machines through the private IP addresses.

This works perfectly except the virtual machines all see the traffic (the IP) as coming from the nginx-proxy-manager.

I've spent hours now trying to get the real client IP address to appear in the access log files on the proxy clients, but nothing works.

So I tried leaving the customer nginx configuration (in the gui) empty, and I have tried adding the lines

set_real_ip_from  IP;
real_ip_header X-Forwarded-For;

With IP being both the public IP address and the private IP address. I tried other combinations I found here and elsewhere, but the bottom line is, nothing ever changes.

On the clients I also tried adding

                RemoteIPHeader X-Forwarded-For
                RemoteIPInternalProxy IP

Again with IP being both the private and the public IP on the nginx-proxy-server, but nothing changes anything.

Surely there must be one correct way to set this up? Is this documented somewhere? I haven't been able to find any, other than man discussions here, and that isn't always clear and usually different situations.

[gillescoolen]

Did you make any progress on the issue? Currently having the same problem, and the fix in this issue does nothing for me.

[pachylover]

In my case, the issue was caused by trying to get X-Forwarded-For when it was not HTTPS.

[BuzzMoody]

Anyone got a fix for this?

[Crash1602]

My question is relevant to the topic, so I'm posting it here.

How can I forward the source IP for a TCP stream? Currently only the Docker Host IP is displayed on the upstream server, so i can´t use Autoblock-IP by failed logins.

Thank you very much.

[baskinsy]

I am looking for this also and can't find something.

[begunfx]

Synology workaround fix for this!

I found a solution for this if you are trying to run NPM (Docker) on a Synology. It seems that there are some pre-routing rules that need to be added to the Synology host for the IP addresses to report the client and not Docker.

I found this post with the solution:

https://www.pedrolamas.com/2020/11/04/exposing-the-client-ips-to-docker-containers-on-synology-nas/

The short of it is you need to apply the following iptable rules on Synology (cli):
sudo iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
sudo iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER

Only catch is that these changes will not sustain post reboot.

In order for that to happen you need to create a boot-up task in the task scheduler and add the script he created so that the rule changes are applied every startup.

I tested the rule changes and it seems I can now properly use the Access List and restrict access to local (LAN) only.
script and instructions here:

https://gist.github.com/pedrolamas/db809a2b9112166da4a2dbf8e3a72ae9

[rardcode]

Hi @Waldorf3!

This works perfectly except the virtual machines all see the traffic (the IP) as coming from the nginx-proxy-manager.

I had the same problem.
After many researches and tests, this solution works for me:
Adding:
proxy_set_header X-Real-IP $remote_addr;
in Nginx Proxy Manager / Edit Proxy Host / Advanced / Custom Nginx Configuration.

I hope it can be useful. 👍

[rardcode]

Hi @filmo
in npm config i have:

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;

I use NPM before Nextcloud server. In Nextcloud config.php i have added:

  'forwarded_for_headers' =>
  array (
    0 => 'HTTP_X_FORWARDED_FOR',
  ),

I hope this can help you!

[segobytes]

Hi @filmo , I have the same issue: I only get the gateway IP address while using Synology’s nginx. I’m wondering if I should set NPM in a docker instead. Did you find a solution ?

[walterzilla]

Hi @filmo , I have the same issue: I only get the gateway IP address while using Synology’s nginx. I’m wondering if I should set NPM in a docker instead. Did you find a solution ?

Did you try setting ­trusted_proxies in Nextcloud config.php also?

[segobytes]

I don't use nextcloud, I use a synology, but I did set the trusted proxies, and no change. Basically without any additional settings, all the clients connecting from outside show up with the nginx reverse proxy host internal ip (192.168.0.9) and if I fill the trusted proxies with;

• either just 192.168.0.9: the external clients show up as 192.168.0.1 (my gateway)
• or 192.168.0.9 and 192.168.0.1: the external clients show up as 192.168.0.1 (my gateway)
  At that stage I gave up trying to make my current config work (synology integrated reverse proxy feature), and I'd rather implement a solution known to work, hence my question about setting up NPM in a separate docker: would that work or would I end up in the samle situation ....

[walterzilla]

I don't use nextcloud

Sorry dude yesterday was seeking hard for a solution for Nextcloud and well I got distracted so to speak......

[Yusseiin]

Someone has been able to fix this?
Nothing in the "Custom Nginx Configuration" seems to working, always getting back the Docker IP

I am on Ubuntu Server

[alemstrom]

probably the most useless post here