Getting real client IP from behind NodeBalancer using nginx

I have a Rails app running under nginx 1.2.8 behind a NodeBalancer.

I have the HttpRealIpModule installed and configured with:

set_real_ip_from; <-- internal IP address of NodeBalancer
real_ip_header X-Forwarded-For;

But all requests are still being logged as coming from in both Rails and nginx logs.

According to the NodeBalancer docs at … for-header">

this is all I need to do. Am I missing something else?


5 Replies

Are you using https (i.e. tcp balancing) if so you can't get the real IP.


Are you using https (i.e. tcp balancing) if so you can't get the real IP.

Yes, I am using HTTPS and hence am using TCP balancing.

I thought that since nginx is doing the SSL termination I would have full visibility into the request & packet (?)

Nope the tcp connection hits the node balancer which then forwards it to your nodes so you'll always see the node balancer IP.

nginx is terminating things, which means you've got an encrypted pipe between you and the user's web browser, and the NodeBlancer can't add the x-forwarded-for header (because it can't modify the encrypted data).

There are other ways you can get the customer's IP if required. If your app uses some sort of session mechanism, start the session on an unencrypted page, store the real IP, then redirect the user to an encrypted page. Or you could use an unencrypted landing page and redirect the user with the real IP as a GET or POST parameter or something.

I'm getting the same issue. Everything is okay with http requests, but https seems to fail with proper x-forwarded-for transfer at some point during client -> balancer -> nginx -> rails connection.

Reference states that it should work as balancer will terminate the SSL connection: … ence-guide">

~~![](<URL url=) … .15.32.png">" />

But it doesn't work for me though.


I was wrong. I'm using TCP instead of HTTPS protocol here.~~


Please enter an answer

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct