11
votes

I have NGINX running as reverse proxy which forwards all http and https traffic to my node.js application, which listens to localhost:port

However the issue I have is that the node.js application sees all incoming requests as coming from ::ffff:127.0.0.1

How can I change the NGINX config such that the real IP will be passed through and forwarded to the node.js application?

server {
    listen 80;
    listen [::]:80;
    listen 443;
    listen [::]:443;

    root /var/www/example.com/html;
    index index.html index.htm;

    server_name example.com;

location / {
proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://localhost:myport;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
}

 # Requests for socket.io are passed on to Node on port x
  location ~* \.io {
  proxy_set_header X-Real-IP   $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Host $http_host;
  proxy_set_header X-NginX-Proxy true;

  proxy_pass http://localhost:myport;
  proxy_redirect off;

  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
}


}

Edit: The express.js/node.js application processes req.ip and has app.enable('trust proxy'); at startup

2
proxy_set_header X-Real-IP $remote_addr I think you already get it right. You should be able to read the real IP from "X-Real-IP" header. What's wrong now? - hackape
How does your nodejs app read IP? - hackape
Thx for your answers. From req.ip - codebird456
I believe you're talking specifically about "express.js app" in place of any general "node.js app". I'd suggest mod your question to reflect this point. - hackape
Also I believe you've read this guide. Look like you've got most things right except one: in nginx conf you proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for. I believe the right answer should be proxy_set_header X-Forwarded-For $remote_addr - hackape

2 Answers

20
votes

Express.js official site has this guide. Instructions:

  1. app.set('trust proxy', true) in js.
  2. proxy_set_header X-Forwarded-For $remote_addr in nginx.conf
  3. You can now read-off the client IP address from req.ip property
2
votes

This solves it taking into consideration above NGINX config.

var ip = req.headers['x-real-ip'] || req.connection.remoteAddress;