blob: b517c84d710e7b5d7a909fe304ed7dcdd3709ece (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
|
=encoding utf-8
=head1 NAME
ngx_http_realip_module - Module ngx_http_realip_module
=head1
The C<ngx_http_realip_module> module is used
to change the client address and optional port
to those sent in the specified header field.
This module is not built by default, it should be enabled with the
C<--with-http_realip_module>
configuration parameter.
=head1 Example Configuration
set_real_ip_from 192.168.1.0/24;
set_real_ip_from 192.168.2.1;
set_real_ip_from 2001:0db8::/32;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
=head1 Directives
=head2 set_real_ip_from
B<syntax:> set_real_ip_from I<
I<C<address>> E<verbar>
I<C<CIDR>> E<verbar>
C<unix:>>
B<context:> I<http>
B<context:> I<server>
B<context:> I<location>
Defines trusted addresses that are known to send correct
replacement addresses.
If the special value C<unix:> is specified,
all UNIX-domain sockets will be trusted.
Trusted addresses may also be specified using a hostname (1.13.1).
B<NOTE>
IPv6 addresses are supported starting from versions 1.3.0 and 1.2.1.
=head2 real_ip_header
B<syntax:> real_ip_header I<
I<C<field>> E<verbar>
C<X-Real-IP> E<verbar>
C<X-Forwarded-For> E<verbar>
C<proxy_protocol>>
B<default:> I<X-Real-IP>
B<context:> I<http>
B<context:> I<server>
B<context:> I<location>
Defines the request header field
whose value will be used to replace the client address.
The request header field value that contains an optional port
is also used to replace the client port (1.11.0).
The address and port should be specified according to
L<RFC 3986|https://datatracker.ietf.org/doc/html/rfc3986>.
The C<proxy_protocol> parameter (1.5.12) changes
the client address to the one from the PROXY protocol header.
The PROXY protocol must be previously enabled by setting the
C<proxy_protocol> parameter
in the L<ngx_http_core_module> directive.
=head2 real_ip_recursive
B<syntax:> real_ip_recursive I<C<on> E<verbar> C<off>>
B<default:> I<off>
B<context:> I<http>
B<context:> I<server>
B<context:> I<location>
This directive appeared in version 1.3.0.
This directive appeared in version 1.2.1.
If recursive search is disabled, the original client address that
matches one of the trusted addresses is replaced by the last
address sent in the request header field defined by the
L</real_ip_header> directive.
If recursive search is enabled, the original client address that
matches one of the trusted addresses is replaced by the last
non-trusted address sent in the request header field.
=head1 Embedded Variables
=over
=item C<$realip_remote_addr>
keeps the original client address (1.9.7)
=item C<$realip_remote_port>
keeps the original client port (1.11.0)
=back
|
