# Preserve client source address when proxying to upstream

**URL:** <https://www.ruby-forum.com/t/preserve-client-source-address-when-proxying-to-upstream/243659>\
**Category:** NGINX\
**Created:** [December 16, 2015, 4:59pm UTC](https://www.ruby-forum.com/t/preserve-client-source-address-when-proxying-to-upstream/243659 "2015-12-16T16:59:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [December 16, 2015, 4:59pm UTC](https://www.ruby-forum.com/t/preserve-client-source-address-when-proxying-to-upstream/243659/1 "2015-12-16T16:59:16Z")

</div>

Hello,

proxy\_bind directive allows to specify source IP address for proxied  
connections.  
This directive can be set to local IP address.

I’m wondering if there’s a way to set $remote\_addr as proxy\_bind  
address?  
Or any other non-local IP address?

The idea is to see original client source IP address at the server site.  
While it’s not http traffic I cannot use XFF header.

Destination MAC address in the response packet from the server is set to  
nginx server interface address. So, there’s no problem at layer 2  
communication.

Can nginx listen for responses coming to non-local destination address?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Vsevolod\_Petrov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/dfb087/32.png) [@Vsevolod\_Petrov](https://www.ruby-forum.com/u/Vsevolod_Petrov)\
**Post date:** [December 16, 2015, 5:56pm UTC](https://www.ruby-forum.com/t/preserve-client-source-address-when-proxying-to-upstream/243659/2 "2015-12-16T17:56:31Z")

</div>

Hello!

On Wed, Dec 16, 2015 at 06:56:02PM +0300, Vsevolod Petrov wrote:

> While it’s not http traffic I cannot use XFF header.
> 
> Destination MAC address in the response packet from the server is set to  
> nginx server interface address. So, there’s no problem at layer 2  
> communication.
> 
> Can nginx listen for responses coming to non-local destination address?

In theory this is possible with appropriate OS-level support, and  
as long as you are able to route packets properly. In particular,  
this should be possible on OpenBSD using SO\_BINDANY, on FreeBSD  
using IP\_BINDANY, and on Linux using IP\_TRANSPARENT/IP\_FREEBIND.

An erlier attempt to make it work on nginx can be found here  
(OpenBSD-specific patch):

> **[totally transparent proxying with nginx on openbsd](http://mailman.nginx.org/pipermail/nginx-devel/2010-October/000533.html)**

As far as I understand, doing proper support should be mostly  
trivial now with variables support in proxy\_bind.

–  
Maxim D.

> **[nginx](http://nginx.org/)**