RealIP

The module is used to change the client address and optional port to those sent in the specified header field.

When building from the source code, this module isn't built by default; it should be enabled with the ‑‑with‑http_realip_module build option.

In packages and images from our repos, the module is included in the build.

Configuration Example

set_real_ip_from  192.168.1.0/24;
set_real_ip_from  192.168.2.1;
set_real_ip_from  2001:0db8::/32;
real_ip_header    X-Forwarded-For;
real_ip_recursive on;

Directives

set_real_ip_from

Syntax	set_real_ip_from address | CIDR | unix:;
Default	—
Context	http, server, location

Defines trusted addresses that are known to send correct replacement addresses. If the special value unix: is specified, all UNIX domain sockets will be trusted. Trusted addresses may also be specified using a hostname.

real_ip_header

Syntax	real_ip_header field | X-Real-IP | X-Forwarded-For | proxy_protocol;
Default	real_ip_header X-Real-IP;
Context	http, server, location

Defines the request header field whose value will be used to replace the client address.

The request header field value that contains an optional port is also used to replace the client port. The address and port should be specified according to RFC 3986.

The proxy_protocol parameter changes the client address to the one from the PROXY protocol header. The PROXY protocol must be previously enabled by setting the proxy_protocol parameter in the listen directive.

real_ip_recursive

Syntax	real_ip_recursive on | off;
Default	real_ip_recursive off;
Context	http, server, location

If recursive search is disabled, the original client address that matches one of the trusted addresses is replaced by the last address sent in the request header field defined by the real_ip_header directive. If recursive search is enabled, the original client address that matches one of the trusted addresses is replaced by the last non-trusted address sent in the request header field.

Built-in Variables

$realip_remote_addr

keeps the original client address

$realip_remote_port

keeps the original client port