Obtaining the client IP address with NGINX

Use NGINX's HTTP real-IP module to read the client address forwarded by an X4B HTTP(S) proxy. See Real IP for applicability; this configuration does not add HTTP headers to arbitrary TCP or UDP services.

Installation

Check the installed build:

nginx -V

Look for --with-http_realip_module in the configure arguments. If the module is unavailable, use your distribution's supported NGINX package or its documented module installation process. Package contents vary; upstream's build default does not tell you whether a distribution includes the module.

Upstream source builds omit this module by default. If you maintain a source build, download and extract a supported release from the NGINX download page. A minimal new installation can be built with:

./configure --with-http_realip_module
make
sudo make install

For an existing installation, preserve its configure arguments, modules and installation paths when adding --with-http_realip_module. Use the supported package for your distribution when you want package-managed installation and updates.

Configuration

Edit nginx.conf (usually /etc/nginx/nginx.conf) or the included configuration for your site. In the appropriate http, server or location context, configure the header and trusted source addresses:

set_real_ip_from 192.0.2.10;
real_ip_header X-Real-IP;

Replace 192.0.2.10 with a current Backend Communication IP Address from the Dashboard and add one set_real_ip_from directive for each current source. Match real_ip_header to the port's Backend Real IP Header setting if you changed it from X-Real-IP.

Validate and reload

  1. Run nginx -t and fix any reported errors.
  2. Reload NGINX using your operating system's service-management method, for example systemctl reload nginx on a systemd installation with that service name.
  3. Make a request through the protected hostname and verify the address seen by the application and access log. $remote_addr contains the substituted client address; $realip_remote_addr retains the connection source.
  4. Verify that a forged header from an untrusted connection cannot override the address. Preserve any firewall restriction that prevents direct access to the backend.

For directive details, see the NGINX real-IP module reference.