Nginx replace REMOTE_ADDR with X-Forwarded-For

问题:

I am quite new to Nginx, and it seems all so confusing. I have my server setup perfectly, but the problem is, since my server is protected using a HTTP proxy; instead of logging the real users IP's, it's logging the proxy server IP.

What I tried doing was setting $_SERVER['REMOTE_ADDR']; to $_SERVER['X-Forwarded-For']; but I'm getting a undefined index error, so I'm guessing I have to define X-Forwarded-For in Nginx? But I am not aware how to do so, I have a simple setup, it's just Nginx with PHP. Nothing more, nothing less.

I've searched all over the web, but can't actually find some information that is friendly to understand.

I have access to the source code, if that somewhat helps. I've tried many solutions, but to no avail.

回答1:

The correct way of doing this is by setting the real_ip_header configuration in nginx.

Example with trusted HTTP proxy IP:

set_real_ip_from 127.0.0.1/32;
real_ip_header X-Forwarded-For;

This way, the $_SERVER['REMOTE_ADDR'] will be correctly filled up in PHP fastcgi.

Documentation link - nginx.org

回答2:

$http_x_forwared_for might contain multiple ip addresses, where the first one should be the client ip. REMOTE_ADDR should only be the client ip.

So by using regex in your nginx.conf, you can set REMOTE_ADDR to the first ip of $http_x_forwarded_for like so:

  set $realip $remote_addr;
  if ($http_x_forwarded_for ~ "^(\d+\.\d+\.\d+\.\d+)") {
    set $realip $1;
  }
  fastcgi_param REMOTE_ADDR $realip;

回答3:

An addition to @fredrik's answer.
It might be better to set $realip using map directive:

map $http_x_forwarded_for $realip {
        ~^(\d+\.\d+\.\d+\.\d+) $1;
        default $remote_addr;
    }

Then, set fastcgi_param REMOTE_ADDR in fastcgi_params file or a location block:

fastcgi_param  REMOTE_ADDR          $real_ip;

回答4:

I solved my own problem, since PHP gets filtered through FastCGI, I simply added a fast CGI param which set REMOTE_ADDR to the variable http_x_forwarded_for, so something similar to this:

fastcgi_param REMOTE_ADDR $http_x_forwarded_for;