Cannot get remote IP from nginx reversal proxy in Java

Question

Currently I am facing a problem with nginx and playframework. I have configured the nginx as reversal proxy in front of my play application.

When I try to read the client ip in java (in play framework), sometimes I can get the correct ip, but sometimes I get "0:0:0:0:0:0:0:1" or even I get multiple ip adresses like "222.72.xxx.xxx, 10.210.44.35, 115.239.xxx.x".

It seems quit wired that it works sometimes, but goes wrong often.

here is my nginx.conf configuration:

http {
    ##
    # Basic Settings
    ##

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme  $scheme;
    proxy_set_header X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header Host  $http_host;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    upstream webapp {
            server localhost:9000;
            server localhost:9002;
    }

    server {
      listen       80;
      listen       [::]:80;
      server_name  myserver.com;
      return       301 http://www.myserver.com$request_uri;
    }

    server {
      listen       80;
      listen       [::]:80;
      server_name  www.myserver.com;

      location /assets/ {
        root      /home/myuser/apps;
      }

      location /static/ {
        expires   30d;
        root      /home/myuser/apps;
      }

      location / {
        proxy_pass  http://webapp;
      }
      location /apis/ {
        proxy_pass  http://localhost:9001;
      }
    }
...
}

here is some log I extraced from access.log of nginx and log from my java application: access.log:

115.239.xxx.x - - [20/Aug/2014:22:30:29 +0200] "GET /news/article/53f00d5efeb89844977b5477 HTTP/1.1" 499 0 "http://www.myserver.com/news/article/53f00d5efeb89844977b5477" "Mozilla/5.0 (iphone; U; CPU iPhone OS 4_3_5 like Mac OS X; en-US) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8J2 Safari/6533.18.5”

java app log:

2014-08-20 22:30:29,621 INFO  application - Activity  - IP: 222.72.xxx.xxx, 10.210.44.35, 115.239.xxx.x, URL: /news/article/53f00d5efeb89844977b5477, UserAgent: Mozilla/5.0 (iphone; U; CPU iPhone OS 4_3_5 like Mac OS X; en-US) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8J2 Safari/6533.18.5

BTW, the server also supports IPV6, that's why I have added the IPv6 support in nginx.conf.

Can anyone help me out?

thanks a lot!

Cheers,

Martin

Answer 1

There is a configuration option in Play which controls whether or not to trust the X-Forwarded-For header sent by Nginx. You need to add

trustxforwarded=true

to your application.conf. Have you done that?

It's in the docs under the heading Advanced proxy settings: https://www.playframework.com/documentation/2.3.x/HTTPServer