Everyone.
And welcome back.
Now, in today's video, we'll be discussing about real IP.
Now, this is a very important topic.
And in fact, in the environment where you have a reverse proxy based setup, this is something that
you will be doing in a production environment.
So let's go ahead and look into it in more detail.
So before we discuss about the real IP, let's look into what is the problem associated with a basic
reverse proxy based setup.
Now let's assume that there are three entities that are involved.
First one is a web browser of a client.
Second one is the Nginx reverse proxy, and third one is the actual backend server.
So the IP address of the client is 192 1680.5.
IP address of nginx is zero dot ten and the IP address of web server is zero dot 20.
Now when a web browser sends the request to the reverse proxy.
Reverse proxy will take this request and send it to the backend server.
Now this backend server in its logs, it will assume that this request is coming from the Nginx reverse
proxy and actually the request is also coming from the Nginx reverse proxy.
But this backend server does not have any way to know the origin of the request.
So the origin of the request is this client's web browser which has the IP address of 1921680.5.
Now, for many of the use cases in production environment, there is a binding that needs to be done
at a client IP level.
So when you require a binding that needs to be done at a client IP level and the client IP address is
not really reaching the application, then such use cases are very difficult to work upon.
So it is considered as a best practice that Nginx will also share the real IP of the client to the backend
server.
So in the earlier case, if you look into the backend server, it has a log of gotta get request from
192 1680. ten, which is the IP address of nginx.
But in the ideal way of doing things in production environment, you will see it.
Now states got get from 192 1680.5, which is nothing but the IP address of the originating client and
this way of doing things is achieved with the help of real IP.
So let's go ahead and look into it practically.
So currently I have a reverse proxy server on the first tab and the backend application server on the
second tab.
Now in the application server, let's do a tail F on the access dot log.
So currently I'm in the var log directory and from the reverse proxy server let's quickly do a curl
localhost or let's do a curl from my web browser itself.
So from my browser, let's go ahead and send a request to the Nginx reverse proxy.
Now we are getting this is application server backend.
This is completely fine.
Now if you look into the application server log, it states that the request is received from an IP
address of ten 139 0.2 This is nothing but the IP address of the nginx reverse proxy server.
So if I do ifconfig you will see this is nothing but the IP address of the reverse proxy server.
Now if you look into the logs associated with the reverse proxy in this log, you are actually getting
the originating client IP.
So this is my current ISP IP address here.
So just to avoid the confusion, let's refresh the page again.
So I'll refresh.
And now you see this is my current IP address of my ISP.
So Nginx reverse proxy is getting the IP address of the client, but the backend server is not really
getting the IP address of the client.
So what we want.
We want to tell Nginx that this specific IP address should also be forwarded to the application server
as well.
So application server should receive both the IP address of the Enginex reverse proxy as well as that
of the client.
And this is the purpose of today's video.
Now what we need to do is we have to add certain configuration, both at the reverse proxy level and
the backend server level.
So what we have to add at a reverse proxy level, we have to send the IP address of the client to the
backend server.
So this is the reason why we have this configuration here of proxy set header.
So we are adding a new header of x IP.
And what is the value associated with this header?
It is remote underscore ADR and also to capture this specific data that is coming from the reverse proxy,
we also have to add the configuration at the backend server level.
So let me quickly show you now when I quickly do a cat on Etsy.
Nginx Enginex.
Conniff over here if you look into the log format.
The log format, the first field that is being captured is the remote underscore ADR, which is nothing
but the IP address of the remote client.
So this is the specific field which is associated with this variable.
And since we want this specific IP address to be sent to the backend server and hence we are adding
a remote ADR variable over here associated with the real IP.
So now what we need to do for the proxy dot conf, we also have to set a header here, so let's add
it.
All right.
So now what we are doing, along with sending the request to the backend server, we are also adding
a new header of real IP which contains the value of the remote ADR here, which is nothing but the IP
address of the originating client and we are sending it to the backend application server.
All right, so this is the first step.
I'll quickly do a next.
Things are successful.
Let's quickly do a restart of enginex.
Perfect.
Now at this specific stage, when I refresh still here, you will see that it is only showing you the
IP address of the reverse proxy.
It is not really showing the IP address of the originating client.
So now at this stage what is happening?
The reverse proxy server is sending this remote addr value to the backend server, but the backend server
log does not really have anything to capture that part.
So now what we have to do, we also have to capture it.
So from the backend server where we also have Nginx that is running, let's do a control C.
If I do a PWD, we are in var log.
Let's quickly go to Etsy Nginx here and let's modify nginx.conf.
All right, nano is not there.
Let's install nano here.
All right.
So now in the log format here under the Http context, we also have to add a field that will fetch the
real IP base header that was set.
So similar to what we see in this slide.
We have to capture this.
So let me add it here.
Great.
So now we are adding it at the last.
So now what will happen in the log?
At the last section you should see the originating client IP.
All right, I'll save this.
Let's do a nginx to verify things are successful.
Let's do a systemctl restart nginx and let's do a tail on var log nginx access dot log.
So now let's refresh the page again.
And this time you see at the start you are getting the reverse proxy IP address and at the end you are
getting the IP address of the originating client.
Great.
So I hope with this you understood the importance of the real IP, the importance of the proxy set header
at the reverse proxy level and also the need of modifying the configuration at the backend server level
as well.
So with this, we'll conclude today's video.