# Nginx as Proxy and IP forwarding **URL:** \ **Category:** NGINX\ **Created:** [March 26, 2010, 8:32pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831 "2010-03-26T20:32:38Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 26, 2010, 8:32pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/1 "2010-03-26T20:32:38Z")
Hi All, I’m in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when doing logging, ip restrictions, etc. Is there anything I can do to make nginx pass the actual client IP without using alternative headers? Thanks, Curtis Posted at Nginx Forum: > **[Nginx as Proxy and IP forwarding](https://forum.nginx.org/read.php?2,68228,68228#msg-68228)** > > Hi All, I'm in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when... ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 26, 2010, 8:48pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/2 "2010-03-26T20:48:26Z")
Hey Curtis, Maybe im misunderstanding your request here but within nginx its very easy to attach the x-forwarded-for value and pass it to the next device/upstream. All you have to do is set the following variable in your proxy configuration file (or per config if you choose to do it seperatly for different upstreams) proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for; Regards, Payam Posted at Nginx Forum: > **[Re: Nginx as Proxy and IP forwarding](https://forum.nginx.org/read.php?2,68228,68235#msg-68235)** > > Hi All, I'm in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when... ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 26, 2010, 8:53pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/3 "2010-03-26T20:53:43Z")
Hi Payam, Thanks for the response, but yes you are slightly misunderstanding, mainly because I don’t think I was clear enough. IIS can not process and X-Forwarded-For header without installing a special ISAPI filter. We can not install the required ISAPI filter because the vendor will not let us. So we are looking for a way to rewrite the IP address that nginx uses when making the request from the backend server. Thanks again, Curtis Posted at Nginx Forum: > **[Re: Nginx as Proxy and IP forwarding](https://forum.nginx.org/read.php?2,68228,68237#msg-68237)** > > Hi All, I'm in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when... ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 26, 2010, 9:11pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/4 "2010-03-26T21:11:51Z")
I see now, i dont think there would be any other work around if you cant install the required scripts to allow iis proper understanding of x-forwarded-for You could re-write the stack and swap remote\_addr for x\_forwarded\_for but that would probably break more things and its not something that is easily done. im assuming you require x-forward for proper session/user management? if so, thought about using phpsessid or something similar then match on the unique cookie and handle the connection properly? If the issue is more of user authentication via real ip then you could use LDAP with nginx and try to authenticate users that way Posted at Nginx Forum: > **[Re: Nginx as Proxy and IP forwarding](https://forum.nginx.org/read.php?2,68228,68240#msg-68240)** > > Hi All, I'm in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when... ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 26, 2010, 9:18pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/5 "2010-03-26T21:18:52Z")
On Fri, Mar 26, 2010 at 03:31:45PM -0400, cschiewek wrote: > Hi All, > > I’m in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when doing logging, ip restrictions, etc. Is there anything I can do to make nginx pass the actual client IP without using alternative headers? No, nginx does not support this: it requires routing on IP (L3) level. – Igor S. > **[Igor Sysoev](http://sysoev.ru/en/)** ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 26, 2010, 11:31pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/6 "2010-03-26T23:31:11Z")
and even on layer3 its not so simple to do this, it would require either a lot of netfilter hooks and perhaps some hacking. another way to do this is if you were using linux on the end dst\_ip server with a broken tcp stack (like kern 2.2 for example). you could use nginx to perform mnm spoof connections … but this will not work as of like 3 years ago =) Posted at Nginx Forum: > **[Re: Nginx as Proxy and IP forwarding](https://forum.nginx.org/read.php?2,68228,68284#msg-68284)** > > Hi All, I'm in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when... ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 27, 2010, 2:08am UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/7 "2010-03-27T02:08:03Z")
heh exactly my point =) Posted at Nginx Forum: > **[Re: Nginx as Proxy and IP forwarding](https://forum.nginx.org/read.php?2,68228,68314#msg-68314)** > > Hi All, I'm in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when... ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 27, 2010, 2:02am UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/8 "2010-03-27T02:02:46Z")
> another way to do this is if you were using linux on the end dst\_ip server > with a broken tcp stack (like kern 2.2 for example). you could use nginx > to perform mnm spoof connections … but this will not work as of like 3 > years ago =) I doubt he is running IIS on Linux 2.2 😉 Best regards, Piotr S. \< [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) \> ---
**Author:** ![cschiewek](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ac8455/32.png) [@cschiewek](https://www.ruby-forum.com/u/cschiewek)\ **Post date:** [March 31, 2010, 3:23pm UTC](https://www.ruby-forum.com/t/nginx-as-proxy-and-ip-forwarding/185831/9 "2010-03-31T15:23:31Z")
Thank you kindly gentlemen. That what I assumed, and was really just looking for confirmation. Posted at Nginx Forum: > **[Re: Nginx as Proxy and IP forwarding](https://forum.nginx.org/read.php?2,68228,69780#msg-69780)** > > Hi All, I'm in a situation where we have a 3rd party canned app (CF and Java on IIS) that we want to put behind an nginx proxy server. Unfortunately, we have no control over the app and or web server so we can not tell it to use X-Forwarded-For when...