HttpRealIp

This module lets to change the client's IP address to value from request header (e. g. X-Real-IP or X-Forwarded-For).

It is useful if nginx works behind some proxy of L7 load balanver, and request come from local IP, but proxy add request header with client's IP.

This module isn't built by default, enable it with the configure option

  1. --with-http_realip_module

User Note: "You will build a list of trusted proxies (see below) and the first IP in the header which is not trusted will be used as the client IP." Source: README of the Apache module mod_extract . Quite informative, about why and how this security feature is helpful.

Example:

  1. set_real_ip_from   192.168.1.0/24;
  2. set_real_ip_from   192.168.2.1;
  3. real_ip_header     X-Real-IP;

鎸囦护

set_real_ip_from

syntax:*set_real_ip_from [the address|CIDR]*

default: none

context:*http, server, location*

This directive describes the trusted addresses, which transfer accurate address for the replacement.

real_ip_header

syntax:*real_ip_header [X-Real-IP|X-Forwarded-For]*

default:*real_ip_header X-Real-IP*

context:*http, server, location*

This directive sets the name of the header used for transferring the replacement IP address.

References

Original Documentation

原文: https://wizardforcel.gitbooks.io/nginx-doc/content/Text/4.7_realip.html