How do I correctly configure Nginx XFF?

user3877654

6/7/23, 5:06 PM

I am trying to follow the directions found here:

https://nginx.org/en/docs/http/ngx_http_realip_module.html

and referenced here:

https://www.loadbalancer.org/blog/nginx-and-x-forwarded-for-header/

and here:

https://stackoverflow.com/questions/43689588/how-to-set-up-realip-module-in-nginx

but I cannot seem to get it right. Here is the relevant Nginx block. Can anyone tell me where I am going wrong?

        location ^~ / {
            try_files $uri @backend;
        }

        location @backend {
            set_real_ip_from  <ip-address>;
            set_real_ip_from  <ip-address>;
            real_ip_header    X-Forwarded-For;
            
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header Referrer-Policy "no-referrer-when-downgrade" always;
            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
        }

In the first set of instructions, the author states that NGINX must be compiled with the --with-http_realip_module. But the others put the module into the config file and restart Nginx. The latter did not work for me, but that might be because I do not have the conf file configured correctly. Which is correct and if Nginx needs to be compiled with the module, can anyone point me to instructions on how to do so for Ubuntu 20.04? I have searched and cannot find additional information.

The output of nginx -V is

nginx version: nginx/1.18.0 (Ubuntu)
built with OpenSSL 1.1.1f  31 Mar 2020
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-KTLRnK/nginx-1.18.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-compat --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_xslt_module=dynamic --with-stream=dynamic --with-stream_ssl_module --with-mail=dynamic --with-mail_ssl_module

0 + 0

nginx

x-forwarded-for

Tero Kilkanen

6/7/23, 9:26 PM

Please add output of `nginx -V` to the question. Are you sure your upstream server sends the IP address in `X-Forwarded-For` header?

user3877654

6/7/23, 9:32 PM

Hi @TeroKilkanen I have added the output of nginx -V above. I am not certain I understand the question. I want to forward all traffic to a fixed IP address and port. The address is functional when I curl it directly.

Tero Kilkanen

6/7/23, 9:38 PM

Your nginx has the `realip` module included. What I asked, are you sure the server that connects to your server is sending the `X-Forwarded-For` header that you want to use as the visitor IP address, instead of the connecting server's IP address? This is the purpose of realip module.

user3877654

6/7/23, 9:41 PM

Ah. Then perhaps I am reading the documentation wrong. What I want to do is connect nginx on my server to a Kubernetes NodePort. My configuration file works when I use the uri, but fails when I reference the ipaddress and port. Is there a way to do this?

Tero Kilkanen

6/7/23, 9:51 PM

Please show the output of `nginx -T` for the full configuration.

user3877654

6/7/23, 10:23 PM

D'oh in trying to answer your request, I found the problem. I was using the ipadress but nginx wanted http://<ipaddress> It successfully passes the tests.