To forward a client’s real IP safely through NGINX, configure the real IP module to trust only your proxy or load-balancer addresses, tell it which field carries the original address, and then send the rewritten $remote_addr upstream. A typical HTTP setup uses set_real_ip_from, real_ip_header X-Forwarded-For, real_ip_recursive on, and explicit proxy_set_header directives.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The order matters. NGINX first decides whether the connecting proxy is trusted and, if so, replaces its client address with the address supplied by that proxy. Only afterward are upstream headers generated. If you trust an untrusted network or accept a spoofed header, your application can record attacker-chosen IP addresses.
As an Amazon Associate I earn from qualifying purchases.
The two-stage configuration
There are two separate jobs in a reverse-proxy deployment:
- Identify the real client. The
ngx_http_realip_modulechanges NGINX’s notion of the client address when the connection comes from a trusted proxy. - Forward that address. The proxy module copies the resulting address into headers such as
X-Real-IPandX-Forwarded-Forsent to the application.
Configuring only the second stage is not enough. If you set X-Real-IP $remote_addr while NGINX still sees the load balancer as the client, your application receives the load balancer’s address. Configuring the real IP module without setting upstream headers leaves the application unaware of the rewritten value.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Before editing nginx.conf
Inventory every network hop
Draw the path from the user to NGINX and then to the application. Record whether each hop adds an X-Forwarded-For or X-Real-IP header, sends PROXY protocol, terminates TLS, or connects directly. The addresses you place in set_real_ip_from must correspond to the systems that are actually allowed to assert a client address.
- A cloud or hardware load balancer may connect from a small published range.
- An internal gateway may use a private subnet that you control.
- A local Unix-socket proxy is represented with
unix:, not an IP CIDR. - Direct public traffic should not be included in a trust range unless those clients are themselves controlled proxies.
Check that the real IP module exists
The real IP module is not built by default in every NGINX build. Check the build options with:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
nginx -V 2>&1Look for --with-http_realip_module. If it is absent, install or build an NGINX package that includes the module before deploying these directives. Validate syntax with nginx -t and inspect the complete active configuration with nginx -T when troubleshooting include-file or context mistakes.
Standard X-Forwarded-For configuration
Place the real IP directives in the http context so they apply to the intended virtual hosts, then set the upstream headers in the relevant location block:
http {
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 192.0.2.10/32;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
upstream app_backend {
server 127.0.0.1:8080;
}
server {
listen 443 ssl;
server_name example.test;
location / {
proxy_pass http://app_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}Replace the example addresses and upstream name with values from your own network. The private range in this example is intentionally broad only to illustrate syntax; use the narrowest range that contains your controlled proxy systems.
set_real_ip_from: the trust boundary
set_real_ip_from address|CIDR|unix: defines which peers may provide replacement address information. NGINX does not treat every incoming X-Forwarded-For value as authoritative. It first checks the address of the connection that delivered the request. A header from a client connecting directly to your public listener is therefore ignored unless that client address falls inside a configured trusted range.
Use individual addresses or tightly scoped CIDRs where possible. If a load balancer has documented egress ranges, include those ranges rather than an entire provider network. Keep the list synchronized with infrastructure changes; an old range can either break legitimate address rewriting or create an unintended trust path.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
real_ip_header: select the source
real_ip_header X-Forwarded-For tells NGINX to read the address chain from that header. If your trusted proxy sends one authoritative address in X-Real-IP, configure real_ip_header X-Real-IP instead. Do not select a field merely because it is common; select the field your immediate trusted hop is documented to populate.
For a TCP load balancer that speaks PROXY protocol, use real_ip_header proxy_protocol and configure the listener as described below. That mode reads the address from the connection preamble rather than from an HTTP header.
real_ip_recursive: handle multiple proxies
With real_ip_recursive on, NGINX walks an X-Forwarded-For chain and chooses the last address that is not in the trusted set. This is appropriate when several controlled proxies append addresses and you want the original client at the left side of the chain.
With recursion off, NGINX uses the last address in the selected header after identifying the connecting peer as trusted. That can be correct for a single proxy that overwrites the field, but it is often wrong when multiple trusted hops append values. Choose the mode according to the behavior of every hop, not according to the number of entries you usually observe.
What the variables contain
| Variable or directive | Meaning after real IP processing | Typical use |
|---|---|---|
$remote_addr |
The address NGINX currently treats as the client; it may be replaced by the real IP module. | Send the client address to the application and include it in access logs. |
$realip_remote_addr |
The original peer address before real IP replacement. | Record the immediate proxy or load balancer separately. |
$proxy_add_x_forwarded_for |
The existing X-Forwarded-For value with the current address appended, or the current address if no value exists. |
Build the chain sent to the upstream. |
set_real_ip_from |
Defines which connecting peers are allowed to supply replacement information. | Limit trust to controlled proxy addresses. |
real_ip_header |
Selects X-Forwarded-For, X-Real-IP, or proxy_protocol as the source. |
Match NGINX to the protocol used by the immediate proxy. |
Forwarding headers to the upstream application
Set headers explicitly instead of relying on defaults. A practical baseline is:
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;X-Real-IP
This single-value header is convenient for applications that need one address. After real IP processing, $remote_addr represents the selected client address. If you need the immediate proxy instead, use $realip_remote_addr in a separate header or log field; do not overwrite the meaning of X-Real-IP silently.
X-Forwarded-For
$proxy_add_x_forwarded_for preserves an existing chain and appends NGINX’s current address. Because real IP processing happens before proxy header construction, the value appended by this variable can be the rewritten client address. In a chain where the original client address is already present, that can produce a duplicate client address. This is expected behavior, not evidence that NGINX failed to identify the client.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
If preserving every hop without duplication is a strict requirement, define and log the chain deliberately, document which proxy owns each append operation, and inspect the resulting header from a controlled request. Do not remove values blindly: the chain may be needed for auditing, rate limiting, or incident response.
X-Forwarded-Proto and host
X-Forwarded-Proto $scheme tells an application whether the client-facing request reached this NGINX listener over HTTP or HTTPS. Host $host preserves the normalized host used for routing. These headers do not establish client identity, but many frameworks use them when generating secure redirects, absolute URLs, and cookie attributes. Configure the application to trust them only when requests can arrive through your controlled NGINX path.
Common deployment patterns
One trusted HTTP proxy
For a single gateway that overwrites X-Forwarded-For with the client address, configure that gateway’s source range, select the field it sends, and consider leaving recursion off. The essential pattern is:
http {
set_real_ip_from 192.0.2.10/32;
real_ip_header X-Forwarded-For;
real_ip_recursive off;
server {
listen 80;
location / {
proxy_pass http://app_backend;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
}This is safe only if the listed proxy is the sole system permitted to connect on that path and its header behavior is known.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSeveral trusted proxies appending a chain
When a public load balancer forwards to an edge proxy and then to NGINX, list every trusted hop that can connect to NGINX and enable recursion:
http {
set_real_ip_from 198.51.100.0/24;
set_real_ip_from 10.20.0.0/16;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
server {
location / {
proxy_pass http://app_backend;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
}The CIDRs above are examples. A trusted range must contain only infrastructure you control. If an untrusted network is included, a requester may inject an address into the chain that NGINX will accept as the client.
A proxy that sends only X-Real-IP
If the immediate trusted proxy supplies a single client address in X-Real-IP, select that header:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
set_real_ip_from 192.0.2.10/32;
real_ip_header X-Real-IP;
real_ip_recursive off;Do not configure X-Forwarded-For simply because the application expects that name. NGINX can still generate an X-Forwarded-For header upstream, but the address-replacement source must match what the trusted proxy actually sends.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Using PROXY protocol correctly
PROXY protocol carries the source and destination addresses in a connection preamble, which is useful when a TCP load balancer forwards TLS or other non-HTTP traffic. NGINX must be told to parse that preamble on the listener before the real IP module can use it.
http {
set_real_ip_from 192.0.2.10/32;
real_ip_header proxy_protocol;
server {
listen 443 ssl proxy_protocol;
server_name example.test;
location / {
proxy_pass http://app_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}The listener and sender must agree
The load balancer must send PROXY protocol and the matching NGINX listen directive must include proxy_protocol. If the sender emits the preamble but the listener does not expect it, the first bytes can be interpreted as invalid HTTP or TLS. If the listener expects it but ordinary clients connect directly, those connections fail because they do not begin with a valid PROXY header.
Do not add proxy_protocol to a listener that receives a mixture of protocol-speaking and ordinary connections. Use a separate address or port, or configure the upstream network so every sender on that listener consistently speaks PROXY protocol.
PROXY protocol and HTTP headers are separate inputs
When using real_ip_header proxy_protocol, the authoritative address comes from the connection preamble. An HTTP X-Forwarded-For header may still exist and can still be forwarded, but it is not the source selected for real IP replacement. Treat the two channels independently and document which system is responsible for each one.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Preserving both the client and the proxy address
Security investigations and access-control rules sometimes need two addresses: the client selected by the real IP module and the immediate peer that connected to NGINX. Use separate log fields:
log_format proxy_chain '$remote_addr client=$remote_addr peer=$realip_remote_addr '
'xff="$http_x_forwarded_for" request="$request"';
access_log /var/log/nginx/access.log proxy_chain;In this example, $remote_addr is the rewritten client address and $realip_remote_addr retains the original connection peer. The raw incoming header is logged as $http_x_forwarded_for so operators can compare what arrived with what NGINX forwarded. Protect logs because addresses and request data can be sensitive.
If the upstream also needs the peer, add a clearly named header:
proxy_set_header X-Proxy-Peer-IP $realip_remote_addr;Only make this header meaningful to applications that know it is set by your NGINX instance. An application exposed directly to the internet must not accept that header as authoritative from arbitrary clients.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security rules that prevent spoofing
- Trust only controlled senders. Never set
set_real_ip_from 0.0.0.0/0or an equivalent broad range for convenience. - Separate public and private paths. If users can reach an NGINX listener directly, do not assume every header on that listener came from your load balancer.
- Keep the application behind the proxy. A direct route to the application lets attackers bypass the header policy and send arbitrary values.
- Define one canonical address source. Mixing an HTTP header and PROXY protocol without documenting precedence leads to inconsistent logs and access controls.
- Review changes to proxy ranges. Infrastructure migrations, autoscaling, and address rotation can change the set of legitimate peers.
- Test forged headers. A direct request containing an invented
X-Forwarded-Formust not change the client address shown in NGINX logs. - Use application trust settings. Frameworks often have their own trusted-proxy or proxy-depth option. Set it to the actual path, or the application may trust client-supplied headers even when NGINX is configured correctly.
Testing procedure
Test from a controlled client and inspect both NGINX and upstream observations. A successful test proves not only that a header appears, but that an untrusted sender cannot choose its value.
- Validate syntax. Run
nginx -t. Correct any context, module, certificate, or include errors before reloading. - Reload safely. Use your service manager’s reload operation so existing connections can finish. Confirm the reload completed successfully.
- Send a normal request. From a known client, request an endpoint that records request metadata or inspect the upstream access log. Compare the client address with the address shown by NGINX.
- Inspect the received chain. Log
$remote_addr,$realip_remote_addr, and$http_x_forwarded_for. Check whether each value matches the documented hop sequence. - Forge a header from an untrusted path. Send a request directly to NGINX with a deliberately false
X-Forwarded-For. The false value must be ignored when the connection source is outsideset_real_ip_from. - Test every proxy hop. Repeat through the real load balancer, edge gateway, IPv4 path, IPv6 path, and any health-check listener that can reach NGINX.
- Test failure behavior. For PROXY protocol, verify that a connection from a non-speaking client is rejected on the protocol-only listener rather than being interpreted as ordinary traffic.
Use a temporary diagnostic log format during testing and remove unnecessary raw-header logging afterward. Do not expose a debug endpoint that returns trusted headers to arbitrary users.
Troubleshooting by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| The application sees the load balancer IP. | The real IP module is missing, the proxy range is not trusted, or the selected header is wrong. | Check nginx -V, set_real_ip_from, real_ip_header, and the raw incoming header. |
A client can choose any IP with X-Forwarded-For. |
An untrusted network was included in set_real_ip_from, or the application is directly exposed. |
Remove the broad trust range, block the direct route, and repeat the forged-header test. |
The client address appears twice in X-Forwarded-For. |
Real IP replacement occurs before $proxy_add_x_forwarded_for appends the current address. |
Compare $remote_addr, $realip_remote_addr, and the original header; redesign chain handling only if a downstream consumer requires it. |
| Every request returns a bad-request or TLS error after enabling PROXY protocol. | The listener expects a PROXY preamble but the sender does not provide one, or the sender provides one to a listener that does not parse it. | Verify both ends use the same protocol and isolate ordinary traffic on another listener. |
real_ip_header proxy_protocol has no effect. |
The listen directive lacks proxy_protocol, or the connecting peer is not trusted. |
Check the exact listener and the source address in set_real_ip_from. |
| Recursion returns an internal proxy address. | One of the legitimate proxy ranges is missing, so NGINX treats that hop as the first untrusted address. | Map the complete chain and add only the controlled ranges that can connect to NGINX. |
| The upstream receives no client header. | The proxy_set_header directives are absent, overridden in a nested context, or attached to a different location. |
Inspect nginx -T and verify the request matches the intended location. |
| HTTP-to-HTTPS redirects use the wrong scheme. | X-Forwarded-Proto is missing or the application does not trust the configured proxy. |
Set the header from $scheme and configure the application’s trusted-proxy policy. |
Choosing the right address source
| Situation | Address source | Trust and recursion choice | Observability requirement |
|---|---|---|---|
| One controlled HTTP proxy sends a single client value. | X-Real-IP or the proxy’s documented single-value field. |
Trust that proxy’s exact address or CIDR; recursion usually off. | Log the rewritten client and original peer. |
| Several controlled HTTP proxies append addresses. | X-Forwarded-For. |
Trust every connecting proxy range; recursion on. | Inspect the complete chain and document append order. |
| A TCP load balancer sends PROXY protocol. | proxy_protocol. |
Trust the load balancer and use listen ... proxy_protocol. |
Keep protocol listeners separate from ordinary connections. |
| Traffic can arrive directly and through a proxy. | The field used by the controlled proxy, but only for trusted peers. | Do not trust public client ranges; use separate listeners or routes where possible. | Log both addresses and test direct spoofing explicitly. |
Operational maintenance
Keep configuration and infrastructure aligned
Store the trusted ranges beside the infrastructure definition that creates the proxies, or maintain a documented change process between the two teams. When a load balancer changes its egress address, update NGINX before switching traffic. After every change, run a normal request and a forged-header test.
Monitor for unexpected peers
Access logs containing both $remote_addr and $realip_remote_addr make it possible to detect a proxy that has disappeared, a new unapproved source, or a route that bypasses the expected gateway. Alerting should focus on unexpected peer addresses and malformed protocol traffic rather than on a fixed client-IP pattern.
Document the contract with application teams
State which header is authoritative, how many trusted proxy hops exist, whether the application receives an address chain, and whether direct access is prohibited. Application developers should not independently reinterpret arbitrary X-Forwarded-For values; they should use the proxy trust settings appropriate for the documented path.
Quick Recap
A minimal production checklist
- The installed build includes
ngx_http_realip_module. - Every
set_real_ip_fromentry identifies a controlled proxy or load balancer. real_ip_headermatches the field or protocol actually sent by the immediate trusted hop.real_ip_recursivematches the number and behavior of trusted HTTP proxies.- The upstream receives explicit
X-Real-IP,X-Forwarded-For, and, when needed,X-Forwarded-Protoheaders. - PROXY protocol is enabled on both sender and listener, and that listener does not accept ordinary connections.
- Logs preserve both the rewritten client address and
$realip_remote_addrwhen the peer identity matters. - Normal, multi-hop, direct, forged-header, and protocol-mismatch tests have been run.
- The application’s own trusted-proxy setting agrees with the NGINX path.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
