client ip behind nginx reverse proxy

Question

I'm running an nginx reverse proxy to be able to run multiple servers behind my firewall. I noticed on my (Kerio) mail server the error log is filled with "failed login from < local ip of nginx >" and I was wondering how can I set it so I get the remote IP of the person/bot that is trying to login so I might use that information for auto blocking those addresses (for example)?

This is my current config:

server {
    listen 8443 ssl http2;
    server_name mail.domain.com;

    location / {
        proxy_set_header Host $host;
        proxy_pass https://<internal ip>/;
        client_max_body_size 0;
        proxy_connect_timeout 3600;
        proxy_send_timeout 3600;
        proxy_read_timeout 3600;
        send_timeout 3600;
    }
}

Adding the following lines, results in more of the same:

proxy_set_header   X-Real-IP          $remote_addr;
proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;

You already passed along the IP address. Whatever software you passed it to must now deal with it. — Michael Hampton, Jun 16 '21 at 20:07
Crap. So basically a no-go is what you're saying since my mailserver shows the local ip only? — vespino, Jun 16 '21 at 20:09
You didn't say what you are passing it to, but generally most software has some way of dealing with this. You should say what you are passing it to. — Michael Hampton, Jun 16 '21 at 20:10
I don't see anything relevant from a quick look through the manual. You should edit your question so that perhaps people familiar with Kerio will be alerted to its existence. — Michael Hampton, Jun 16 '21 at 20:19
https://forums.kerio.com/index.php?t=msg&goto=147601& has info on what to do for Kerio. — Mark Wagner, Jun 16 '21 at 23:12
Thanks for pointing me to that post. It doesn't work right away, but I'll reach out on the forum to try and get it fixed. — vespino, Jun 17 '21 at 06:07

score 0 · Answer 1 · answered Jun 16 '21 at 20:52

0

X-Forwarded-For is the feature you need and this will add a http header containing the original client IP. From what you are saying the Kerio Application is ignoring this and just using the Source IP (which is the nginx) in the Logs. Perhaps there is an option to analyse and use this that can be configured on the application.

answered Jun 16 '21 at 20:52

Barry Gleeson

1
1

So what is the option? This post is useless without that information. – Michael Hampton Jun 16 '21 at 20:55
Like you said there is nothing in the docs on how to configure this in Kerio. since the Q was in relation to the nginx config its worth calling out that this is correct as the forwarded for header is being added. – Barry Gleeson Jun 16 '21 at 21:07

score 0 · Answer 2 · answered Jun 17 '21 at 10:14

0

Just found out my mail server (Kerio) does nothing with the information forwarded by the reverse proxy, so the only thing I can do is hope for an update that does.

answered Jun 17 '21 at 10:14

vespino

111
3

client ip behind nginx reverse proxy

2 Answers2