# Stud -\> Haproxy -\> and Nginx; nginx real\_ip\_header isn't working as expected, can't scale **URL:** \ **Category:** NGINX\ **Created:** [August 31, 2012, 8:33pm UTC](https://www.ruby-forum.com/t/stud-haproxy-and-nginx-nginx-real-ip-header-isnt-working-as-expected-cant-scale/222533 "2012-08-31T20:33:26Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [August 31, 2012, 8:33pm UTC](https://www.ruby-forum.com/t/stud-haproxy-and-nginx-nginx-real-ip-header-isnt-working-as-expected-cant-scale/222533/1 "2012-08-31T20:33:26Z")
I got through all of that, finally i’m to nginx… I only have one load balancer at the moment, but given the addition of a second or third in which I cannot rely on all of the ip addresses to be expressible any other way than 0.0.0.0/24. set\_real\_ip\_from 10.0.0.0/24; real\_ip\_header X-Forwarded-For; This simply does not work, however if I put a single load balancers IP address there, it does. It seems like you guys went out of your way to make sure that people set /something/ rather than nothing with the real\_ip\_header variable which is good, the bad thing is you’re not leaving me many options as far as overriding the behavior of preventing me from allowing anybody in the world to send X-Forwarded-For… …which doesn’t make any sense because thanks to iptables the only machine that could ever send that would be my load balancer or balancers: ACCEPT tcp – 10.178.101.53 anywhere tcp dpt:http ACCEPT tcp – 10.178.101.53 anywhere tcp dpt:https I’m begging you guys please. Please don’t save me from myself, completely. Please. I have absolutely no need for this behavior, given that stud, my ssl terminator, gets the tcp remote connection ip which it uses for X-Forwarded-For, which in turn is sent to haproxy… and the nginx servers only allow connections from the haproxy server… oh another important thing to mention is that stud runs on the load balancer server(s). Again there could end up being multiple stud+haproxy servers that could talk to the nginx nodes… CIDR can’t express random ip addresses… please fix set\_real\_ip\_from to allow 0.0.0.0/24. Thank you, Paige Adele Thompson > **[paigeat](https://www.paigeat.info/)** > > paigeat removed\_email\_address@domain.invalid ---
**Author:** ![ThompsonS\_Paige](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/d2c977/32.png) [@ThompsonS\_Paige](https://www.ruby-forum.com/u/ThompsonS_Paige)\ **Post date:** [September 1, 2012, 12:35am UTC](https://www.ruby-forum.com/t/stud-haproxy-and-nginx-nginx-real-ip-header-isnt-working-as-expected-cant-scale/222533/2 "2012-09-01T00:35:18Z")
On Fri, Aug 31, 2012 at 11:32:13AM -0700, Thompson, Paige wrote: Hi there, > I only have one load balancer at the moment, but given the addition of > a second or third in which I cannot rely on all of the ip addresses to > be expressible any other way than 0.0.0.0/24. > > set\_real\_ip\_from 10.0.0.0/24; You’ve used two different cidr addresses there. It’s not clear which one you actually mean. Are you aware that 10.0.0.0/24 means “10.0.0.anything”? If you want “10.anything”, that is 10.0.0.0/8. > real\_ip\_header X-Forwarded-For; > > This simply does not work, however if I put a single load balancers IP > address there, it does. It looks to me like it should work. And a quick test of curl -i -H ‘X-Forwarded-For: 10.0.1.99’ [http://localhost:8080/](http://localhost:8080/) shows “10.0.1.99” as the first field in access.log. What does your set\_real\_ip\_from directive say? And what is the IP address of the load balancer that is talking to nginx? I suspect that when you configure it right, nginx will work fine. Good luck with it, ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![ThompsonS\_Paige](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/d2c977/32.png) [@ThompsonS\_Paige](https://www.ruby-forum.com/u/ThompsonS_Paige)\ **Post date:** [September 1, 2012, 12:42am UTC](https://www.ruby-forum.com/t/stud-haproxy-and-nginx-nginx-real-ip-header-isnt-working-as-expected-cant-scale/222533/3 "2012-09-01T00:42:54Z")
On Fri, Aug 31, 2012 at 11:34:45PM +0100, Francis D. wrote: > On Fri, Aug 31, 2012 at 11:32:13AM -0700, Thompson, Paige wrote: Hi there, > And a quick test of > > curl -i -H ‘X-Forwarded-For: 10.0.1.99’ [http://localhost:8080/](http://localhost:8080/) > > shows “10.0.1.99” as the first field in access.log. …when my source address was 127.0.0.1 and my important other directive was set\_real\_ip\_from 127.0.0.0/16; in order to include my source address in the set\_real\_ip\_from network ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)