Question 97329 in Nginx Question posted in
The official documentation can be found here.

Restore Client IP behind Ingress – Nginx

I have such setup of K8S:

Cloudflare -> Digital Ocean Load Balancer -> Nginx Ingress -> Nginx Container

Based on my answer on this question all works fine up to Nginx Ingress here I get the correct IP of the user.

But inside Nginx Contaier the IP is set to the service IP.

I restored it by using:

set_real_ip_from 0.0.0.0/0;
real_ip_header X-Forwarded-For;

But I don’t trust this line: set_real_ip_from 0.0.0.0/0; becuase is from any IP, I can’t get CIDR of ingress service.

My question is there is a better way to restore client IP inside nginx container when request are coming from Ingress Service?

Tags:

2

Answers


  1. 0

    If you can read the headers forwarded by Cloudflare, a proxied request will include the CF-Connecting-IP header which will contain the IP of the client that connected to Cloudflare in first place.

    (docs)

    Login or Signup to reply.
  2. 0

    There is no better way to restore the client IP.
    However, you should only allow cloudflares IP address ranges with set_real_ip_from as described here (note that the german version of this example is much better than the english):

    https://support.cloudflare.com/hc/de/articles/200170786-Wiederherstellen-von-urspr%C3%BCnglichen-Besucher-IPs-Protokollieren-von-Besucher-IP-Adressen-mit-mod-cloudflare-

    set_real_ip_from 103.21.244.0/22;set_real_ip_from 103.22.200.0/22;set_real_ip_from 103.31.4.0/22;set_real_ip_from 104.16.0.0/12;set_real_ip_from 108.162.192.0/18;set_real_ip_from 131.0.72.0/22;set_real_ip_from 141.101.64.0/18;set_real_ip_from 162.158.0.0/15;set_real_ip_from 172.64.0.0/13;set_real_ip_from 173.245.48.0/20;set_real_ip_from 188.114.96.0/20;set_real_ip_from 190.93.240.0/20;set_real_ip_from 197.234.240.0/22;set_real_ip_from 198.41.128.0/17;set_real_ip_from 2400:cb00::/32;set_real_ip_from 2606:4700::/32;set_real_ip_from 2803:f800::/32;set_real_ip_from 2405:b500::/32;set_real_ip_from 2405:8100::/32;set_real_ip_from 2c0f:f248::/32;set_real_ip_from 2a06:98c0::/29;

    The list of ip address ranges may change from time to time. It can be found here:
    https://www.cloudflare.com/ips/

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search