# Nginx/iptables passing ipclient ip **URL:** \ **Category:** NGINX\ **Created:** [November 29, 2013, 11:45pm UTC](https://www.ruby-forum.com/t/nginx-iptables-passing-ipclient-ip/237793 "2013-11-29T23:45:10Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\ **Post date:** [November 29, 2013, 11:45pm UTC](https://www.ruby-forum.com/t/nginx-iptables-passing-ipclient-ip/237793/1 "2013-11-29T23:45:10Z")
Hi, I have nginx reverse proxy setup on a ubuntu server to pass to webservers… Setup… Ubuntu-nginx eth1 = external\_ ip eth0 = internal\_ ip Webserver 1 ip XX1 webserver 2 ip XX2 nginx is forwarding traffic to webservers… I tried both… proxy\_set\_header X-Forwarded-For $remote\_addr; proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for; I have iptables for my firewall with proper ports and IPs open… the ip address I still see in the logs is the eth0 = internal\_ ip I can change the ip the webserver is seeing using POSTROUTING SNAT iptables… This lead me to believe I have something miss configured that the Nginx can not pass the real client IP to the webservers… Thanks, Posted at Nginx Forum: > **[Nginx/iptables passing ipclient ip](https://forum.nginx.org/read.php?2,245092,245092#msg-245092)** > > Hi, I have nginx reverse proxy setup on a ubuntu server to pass to webservers... Setup.. Ubuntu-nginx eth1 = external\_ ip eth0 = internal\_ ip Webserver 1 ip XX1 webserver 2 ip XX2 nginx is forwarding ---
**Author:** ![ToddSVRG](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3d9bf3/32.png) [@ToddSVRG](https://www.ruby-forum.com/u/ToddSVRG)\ **Post date:** [November 30, 2013, 12:03am UTC](https://www.ruby-forum.com/t/nginx-iptables-passing-ipclient-ip/237793/2 "2013-11-30T00:03:16Z")
On Fri, Nov 29, 2013 at 05:44:41PM -0500, Todd@VRG wrote: Hi there, > nginx is forwarding traffic to webservers… > proxy\_set\_header X-Forwarded-For $remote\_addr; > the ip address I still see in the logs is the eth0 = internal\_ ip Using tcpdump, or otherwise, watch the request going from nginx to the web server. Does is have what you expect to see in the X-Forwarded-For: header? If so, nginx is doing all it can do; you must configure the web server to make use of that header value instead of the address that it actually sees the connection coming from. That web server documentation should say how to do that. ## f Francis D. removed\_email\_address@domain.invalid ---
**Author:** ![ToddSVRG](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/3d9bf3/32.png) [@ToddSVRG](https://www.ruby-forum.com/u/ToddSVRG)\ **Post date:** [November 30, 2013, 12:22pm UTC](https://www.ruby-forum.com/t/nginx-iptables-passing-ipclient-ip/237793/3 "2013-11-30T12:22:33Z")
On Fri, Nov 29, 2013 at 11:44 PM, Todd@VRG [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I have iptables for my firewall with proper ports and IPs open… > > the ip address I still see in the logs is the eth0 = internal\_ ip > I can change the ip the webserver is seeing using POSTROUTING SNAT > iptables… > > This lead me to believe I have something miss configured that the Nginx can > not pass the real client IP to the webservers… Disclaimer: maybe I’ve misunderstood you 🙂 Do you realize that “proxy\_set\_header X-Forwarded-For $remote\_addr;” what would do is change the HTTP header, not the IP header. What this means is that your internal facing web servers will see IP traffic with SRC=internal\_ip, however if you inspect the HTTP headers of those requests, you will find that there is and HTTP.X-Forwarded-For set to $remote\_addr; no more, no less than that 🙂 ## br Marc