Wrong ip when using nginx reverse proxy

[ifamirhasan]

PROBLEM

I'm using nginx to reverse proxy signaling phase of webrtc every thing is ok but I get wrong ip in admission webhook. it is local ip. Also I checked the logs and I saw both local ip and my real ip.

this is my nginx config:

location /live/ {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_redirect off;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_pass http://ome:3333;
}

[getroot]

If nginx is proxying, only nginx's IP is known to OME. There is no way to know the IP of the client.

[basisbit]

there exist X-REAL-IP and X-FORWARDED-FOR headers for such cases. Please add support for getting the ip address from these headers, if ome is used behind a reverse proxy or http load balancer.

[getroot]

@basisbit Thanks for letting me know about X-REAL-IP, X-FORWAREDED-FOR.

In order for OME to support this without any security problems, if the user enables X-REAL-IP in the AdmissionWebhooks setting of Server.xml, it will be necessary to set the proxy IP as a required option and allow only connections from nginx.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[basisbit]

*bump* Keeping this open because it is a rather common use case, and having the error log contain the public IPv4/IPv6 address can be important for legal reasons.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[basisbit]

bump

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[koss89]

bump

For resolve security you can use case of nginx. Explain Add to config option trustedProxy if proxy in list trustedProxy (X-FORWARDED-FOR) use ip from X-REAL-IP