Score:1

Server

Why is my server getting connections from its own IP?

instamattic

3/10/23, 11:26 PM

The most numerous connecting IP is my server's own IP.

It's Debian 10, Nginx, Mysql machine serving a single Wordpress and phpBB site. It's a virtual machine on Google's Cloud.

I'm obviously not too hot with this stuff, but good enough to build up a machine and have it serve the site.

$ sudo awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

returns

5122 104.198.149.xxx

4268 157.90.209.xxx

3752 93.158.90.xxx

1982 68.68.32.xxx

[...]

~ ~ ~

104.198.149.xxx is my server.

Output of

grep 104.198.149.xxx /var/log/nginx/access.log

162.158.252.xxx - - [11/Nov/2021:00:00:25 -0700] "GET /forums/ HTTP/1.1" 200 12459 "https://104.198.149.xxx/forums" "Mozilla/5.0 (compatible;Cloudflare-Healthchecks/1.0;+https://www.cloudflare.com/; healthcheck-id: bfa5d32ce9a5eaf8)"  
  
172.69.32.xxx - - [11/Nov/2021:00:00:59 -0700] "GET /forums/ HTTP/1.1" 200 12471 "https://104.198.149.xxx/forums" "Mozilla/5.0 (compatible;Cloudflare-Healthchecks/1.0;+https://www.cloudflare.com/; healthcheck-id: bfa5d32ce9a5eaf8)"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:00 -0700] "POST /wp/wp-cron.php?doing_wp_cron=1636614060.6961169242858886718750 HTTP/1.1" 200 31 "https://www.example.com/wp/wp-cron.php?doing_wp_cron=1636614060.6961169242858886718750" "WordPress/5.8.2; https://www.matthewsvolvosite.com"  
  
108.162.220.xxx - - [11/Nov/2021:00:01:03 -0700] "GET /forums/ HTTP/1.1" 200 12465 "https://104.198.149.xxx/forums" "Mozilla/5.0 (compatible;Cloudflare-Healthchecks/1.0;+https://www.cloudflare.com/; healthcheck-id: bfa5d32ce9a5eaf8)"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:07 -0700] "GET /forums/download/file.php?id=30434&amp;mode=view HTTP/1.0" 200 641193 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:07 -0700] "GET /forums/download/file.php?id=30435&amp;mode=view HTTP/1.0" 200 933139 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:10 -0700] "GET /forums/download/file.php?id=55475&amp;mode=view HTTP/1.0" 200 1015069 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:10 -0700] "GET /forums/download/file.php?id=55476&amp;mode=view HTTP/1.0" 200 933149 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:10 -0700] "GET /forums/download/file.php?id=55477&amp;mode=view HTTP/1.0" 200 916765 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:17 -0700] "GET /forums/download/file.php?id=30691&amp;mode=view HTTP/1.0" 200 121584 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:18 -0700] "GET /forums/download/file.php?id=30692&amp;mode=view HTTP/1.0" 200 137607 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:18 -0700] "GET /forums/download/file.php?id=30693&amp;mode=view HTTP/1.0" 200 133153 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:24 -0700] "GET /forums/download/file.php?id=33292&amp;mode=view HTTP/1.0" 200 949523 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:25 -0700] "GET /forums/download/file.php?id=33293&amp;mode=view HTTP/1.0" 200 1047827 "-" "-"  
  
104.198.149.xxx - - [11/Nov/2021:00:01:25 -0700] "GET /forums/download/file.php?id=33294&amp;mode=view HTTP/1.0" 200 916755 "-" "-"

265

0 + 0

nginx

debian-buster

Tero Kilkanen

3/11/23, 6:59 AM

Please add about ten lines from `grep 104.198.149.xxx /var/log/nginx/access.log` output to your question.

Score:2

Server

Cipher Menial

3/11/23, 12:15 AM

The reason you will see connections from your servers IP is usually due to using a reverse proxy. Over the years there has been changes to how this can be resolved.

The original way was using the X-Forwarded-For header. Then there was a standardised way of doing it with RFC 7239 which is called Forwarded. Here is an article from NGINX explaining this.

The final option is to use the proxy protocol. HERE is the official documentation around this from NGINX.

To understand this all more in depth here is a fantastic post explaining it all.

0 + 0

instamattic

3/11/23, 12:43 AM

Inside a location block inside /etc/nginx/sites-enabled/mysite.com there is `fastcgi_param HTTP_PROXY '';` Could that be doing it? There is no proxy anything in Nginx's config file. But there is `server { listen 127.0.0.1:80; server_name 127.0.0.1; location /nginx_status { stub_status on; allow 127.0.0.1; deny all; } }` in /etc/nginx/conf.d/stub_status.conf, which at least to me suggests the Nginx server is listening to itself.

instamattic

3/12/23, 3:43 PM

Cipher, thanks for the links. But it's all over my head. I'm not (at least intentionally) running a proxy. There is no Apache on this machine processing the requests and sending to Nginx, for instance.

Score:2

Server

Tero Kilkanen

3/12/23, 11:30 PM

This is an educated guess.

You have a WordPress plugin that somehow views files uploaded to the phpBB forum you have. Internally it downloads the file from phpBB, and then presents it via some WordPress -side page.

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why is my server getting connections from its own IP?

TH: เหตุใดเซิร์ฟเวอร์ของฉันจึงได้รับการเชื่อมต่อจาก IP ของตัวเอง

RO: De ce serverul meu primește conexiuni de la propriul IP?

RU: Почему мой сервер получает соединения со своего собственного IP-адреса?

VI: Tại sao máy chủ của tôi nhận kết nối từ IP của chính nó?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.