# NginX SSL reverse mode, client ip address problem

**URL:** <https://www.ruby-forum.com/t/nginx-ssl-reverse-mode-client-ip-address-problem/243574>\
**Category:** NGINX\
**Created:** [December 6, 2015, 7:14am UTC](https://www.ruby-forum.com/t/nginx-ssl-reverse-mode-client-ip-address-problem/243574 "2015-12-06T07:14:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [December 6, 2015, 7:14am UTC](https://www.ruby-forum.com/t/nginx-ssl-reverse-mode-client-ip-address-problem/243574/1 "2015-12-06T07:14:42Z")

</div>

In NginX reverse mode,

There is a problem that can’t get real client’s Ip address.

If I use Http protocol, I can simply handle this problem with below http  
configuration.

http {  
server {  
listen 80;  
location / {  
proxy\_set\_header X-forwarded-for;  
proxy\_pass [http://destAddress](http://destAddress);  
}  
}  
}

The problem is in SSL.

I don’t want to use http ssl listen becase of SSL handshaking burden on  
NginX.

I decided to use stream codec like below.

stream {  
upstream aa34 {  
zone first\_row 64k;  
server [google.com](http://google.com) fail\_timeout=5s;  
}  
server {  
listen 127.0.0.1:8081;  
location / {  
proxy\_pass [https://aa34](https://aa34);  
}  
}  
In this case, I think I can’t specify any http related parameters like  
‘X-forwarded-for’.  
Is there any way to change source ip address of TCP/IP Protocol  
header(Ip  
Header) to client’s real Ip ?

Thanks.

Posted at Nginx Forum:

> **[NginX SSL reverse mode, client ip address problem](https://forum.nginx.org/read.php?2,263299,263299#msg-263299)**
>
> In NginX reverse mode, There is a problem that can't get real client's Ip address. If I use Http protocol, I can simply handle this problem with below http configuration. http { server { listen 80; location / {

---

<div class="post-metadata">

**Author:** ![WANJUNE](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/3ab097/32.png) [@WANJUNE](https://www.ruby-forum.com/u/WANJUNE)\
**Post date:** [December 6, 2015, 11:18am UTC](https://www.ruby-forum.com/t/nginx-ssl-reverse-mode-client-ip-address-problem/243574/2 "2015-12-06T11:18:18Z")

</div>

Hi WANJUNE.

Am 06-12-2015 07:14, schrieb WANJUNE:

> In NginX reverse mode,
> 
> There is a problem that can’t get real client’s Ip address.

[snipp]

> ```
> server {
> listen 127.0.0.1:8081;
> location / {
> proxy_pass https://aa34;
> }
> 
> ```
> 
> }  
> In this case, I think I can’t specify any http related parameters like  
> ‘X-forwarded-for’.  
> Is there any way to change source ip address of TCP/IP Protocol  
> header(Ip  
> Header) to client’s real Ip ?

How about to use the proxy protocol?  
[http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt](http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt)

This option was introduced in 1.9.2

##############  
[http://nginx.org/en/CHANGES](http://nginx.org/en/CHANGES)  
Changes with nginx 1.9.2 16 Jun  
2015

\*) Feature: the “proxy\_protocol” directive in the stream module.  
##############

It’s not yet in the documentation but in the code 😉

> **[Module ngx\_stream\_core\_module](http://nginx.org/en/docs/stream/ngx_stream_core_module.html)**

I would suggest to use the following line

```
      server <YOUR_SERVER> fail_timeout=5s proxy_protocol;

```

and on the origin server, in case it is nginx, this.

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#listen)**
>
> This directive appeared in version 1.11.8.

listen … proxy\_protocol …;

If your destiation server is not able to read the proxy protocol then  
you only DSR (direct Server Return) is able to show you the client IP.

Cheers Aleks

---

<div class="post-metadata">

**Author:** ![WANJUNE](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/3ab097/32.png) [@WANJUNE](https://www.ruby-forum.com/u/WANJUNE)\
**Post date:** [December 6, 2015, 12:04pm UTC](https://www.ruby-forum.com/t/nginx-ssl-reverse-mode-client-ip-address-problem/243574/3 "2015-12-06T12:04:28Z")

</div>

Aleks, I’m really thank you for your timely response.  
I checked “proxy\_protocol on;” option is working fine and watched the L4  
machine send proxy protocol header like “PROXY TCP4 [Ip1] [Ip2] [Port1]  
[Port2]”.  
Really thank you.

Posted at Nginx Forum:

> **[Re: NginX SSL reverse mode, client ip address problem](https://forum.nginx.org/read.php?2,263299,263302#msg-263302)**
>
> In NginX reverse mode, There is a problem that can't get real client's Ip address. If I use Http protocol, I can simply handle this problem with below http configuration. http { server { listen 80; location / {