Home / Nginx / How to Fix Nginx Real IP Header Issues

Nginx

How to Fix Nginx Real IP Header Issues

Resolve Nginx real IP detection issues including wrong client IP, proxy header problems, and Cloudflare IP extraction failures.

Published: Nov 28, 20259 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

# Nginx Real IP Header Issues

Your application receives all requests from the same IP address - the load balancer, CDN, or proxy IP. User-specific features fail, rate limiting is ineffective, and logs show no real client diversity. The X-Forwarded-For header exists, but Nginx isn't using it. Real IP detection requires the ngx_http_realip_module and proper configuration.

Introduction

This article covers troubleshooting steps and solutions for How to Fix Nginx Real IP Header Issues. The error typically occurs in production environments and can cause service disruptions if not addressed promptly.

Symptoms

Common error messages include:

bash

curl -H "X-Forwarded-For: 203.0.113.50" http://localhost/test

nginx

add_header X-Detected-IP $remote_addr always;

```bash # Check if module is compiled nginx -V 2>&1 | grep real_ip

# Check for dynamic module ls /etc/nginx/modules/ | grep realip

# Check configuration grep -r "set_real_ip_from" /etc/nginx/ ```

Common Causes

Configuration misconfiguration
Missing or incorrect credentials
Network connectivity issues
Version compatibility problems
Resource exhaustion or limits
Permission or access denied

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Understanding Real IP Detection

1.When requests pass through proxies:
2.Client connects to proxy with real IP
3.Proxy connects to Nginx with proxy IP
4.Proxy adds X-Forwarded-For header with real IP

1.Nginx must:
2.Trust the proxy (set_real_ip_from)
3.Know which header contains the real IP (real_ip_header)
4.Replace $remote_addr with the real client IP

Check current detected IP: ``bash curl -H "X-Forwarded-For: 203.0.113.50" http://localhost/test

Add diagnostic header: ``nginx add_header X-Detected-IP $remote_addr always;

Common Cause 1: Real IP Module Not Loaded

The module must be compiled or loaded.

Diagnosis: ```bash # Check if module is compiled nginx -V 2>&1 | grep real_ip

# Check for dynamic module ls /etc/nginx/modules/ | grep realip

# Check configuration grep -r "set_real_ip_from" /etc/nginx/ ```

Solution: Load module if dynamic: ``nginx # In nginx.conf main context load_module modules/ngx_http_realip_module.so;

Or install module: ```bash # Ubuntu/Debian - usually included in nginx-full sudo apt install nginx-full

# CentOS/RHEL - usually included by default sudo yum install nginx ```

Verify module: ``bash sudo nginx -t # Should not error on set_real_ip_from directive

Common Cause 2: Proxy IP Not Trusted

Only trusted proxies should provide real IPs.

Problematic config: ``nginx real_ip_header X-Forwarded-For; # No set_real_ip_from - any client can spoof their IP

Solution: Define trusted proxies: ```nginx # Cloudflare IPs set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 108.162.192.0/18; set_real_ip_from 131.0.72.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 162.158.0.0/15; set_real_ip_from 172.64.0.0/13; set_real_ip_from 173.245.48.0/20; set_real_ip_from 188.114.96.0/15; set_real_ip_from 190.93.240.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.0.0/17; set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32;

# AWS ALB set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.16.0.0/12;

real_ip_header CF-Connecting-IP; # For Cloudflare # or real_ip_header X-Forwarded-For; # For generic proxies

real_ip_recursive on; ```

Common Cause 3: Wrong Header Used

Different proxies use different headers.

Cloudflare: CF-Connecting-IP AWS ALB: X-Forwarded-For Generic proxy: X-Forwarded-For or X-Real-IP

Problematic config: ``nginx set_real_ip_from 103.21.244.0/22; # Cloudflare real_ip_header X-Forwarded-For; # Cloudflare sends CF-Connecting-IP, X-Forwarded-For might have multiple IPs

Solution: Use correct header: ```nginx # For Cloudflare set_real_ip_from 103.21.244.0/22; real_ip_header CF-Connecting-IP;

# For AWS ALB set_real_ip_from 10.0.0.0/8; real_ip_header X-Forwarded-For;

# For custom proxy set_real_ip_from 192.168.1.100; real_ip_header X-Real-IP; ```

Common Cause 4: X-Forwarded-For Chain Issues

X-Forwarded-For contains a chain of IPs: client, proxy1, proxy2, etc.

Header format: ``X-Forwarded-For: 203.0.113.50, 10.0.0.1, 172.16.0.2

Problem: Nginx takes the first IP without real_ip_recursive: ``nginx set_real_ip_from 10.0.0.0/8; real_ip_header X-Forwarded-For; # $remote_addr becomes 172.16.0.2 (last IP, closest to Nginx)

Solution: Enable recursive: ``nginx set_real_ip_from 10.0.0.0/8; # Trust first proxy set_real_ip_from 172.16.0.0/12; # Trust second proxy real_ip_header X-Forwarded-For; real_ip_recursive on; # Now Nginx walks through chain, stops at first untrusted IP # Result: $remote_addr = 203.0.113.50 (real client)

Common Cause 5: Multiple Proxies Not All Trusted

Chain includes untrusted proxies, stopping resolution too early.

Problem: ```nginx set_real_ip_from 172.16.0.0/12; real_ip_header X-Forwarded-For; real_ip_recursive on;

# X-Forwarded-For: 203.0.113.50, 10.0.0.1, 172.16.0.2 # 172.16.0.2 is trusted, 10.0.0.1 is NOT trusted # Result: $remote_addr = 10.0.0.1 (intermediate proxy) ```

Solution: Trust all proxies in chain: ``nginx set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.16.0.0/12; set_real_ip_from 192.168.0.0/16; real_ip_header X-Forwarded-For; real_ip_recursive on;

Common Cause 6: Header Spoofing Not Prevented

Without trusted proxy list, clients can spoof IPs.

Problematic config: ``nginx real_ip_header X-Forwarded-For; # No set_real_ip_from # Client can send: X-Forwarded-For: 8.8.8.8 # Nginx believes client is 8.8.8.8

Solution: Always set trusted proxies: ``nginx # Only trust your actual proxies set_real_ip_from 192.168.1.100; # Your load balancer set_real_ip_from 10.0.0.50; # Your CDN origin real_ip_header X-Forwarded-For;

Test spoofing protection: ```bash # Direct request (not through trusted proxy) curl -H "X-Forwarded-For: 8.8.8.8" http://your-server/test # Should NOT show 8.8.8.8 as remote_addr

# Request through trusted proxy curl -H "X-Forwarded-For: 203.0.113.50" --proxy 192.168.1.100 http://your-server/test # Should show 203.0.113.50 as remote_addr ```

Common Cause 7: Application Not Using $remote_addr

Nginx corrects the IP, but application reads wrong header.

Problem: ```nginx set_real_ip_from 10.0.0.0/8; real_ip_header X-Forwarded-For;

# Application reads X-Forwarded-For directly, not $remote_addr # Application might get wrong IP from chain ```

Solution: Forward corrected IP: ```nginx location / { set_real_ip_from 10.0.0.0/8; real_ip_header X-Forwarded-For;

proxy_pass http://backend; # Nginx's $remote_addr now contains real IP proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } ```

$proxy_add_x_forwarded_for: - Starts with $remote_addr (the corrected real IP) - Appends original X-Forwarded-For if present - Backend receives clean chain starting with real client

Common Cause 8: Cloudflare IPv6 Not Trusted

IPv6 Cloudflare IPs missing from trusted list.

Problem: ``nginx set_real_ip_from 103.21.244.0/22; # IPv4 only real_ip_header CF-Connecting-IP; # IPv6 clients still show Cloudflare IPv6 IP

Solution: Include IPv6 ranges: ```nginx # IPv4 set_real_ip_from 103.21.244.0/22; set_real_ip_from 173.245.48.0/20; # ... other IPv4 ranges

# IPv6 set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32;

real_ip_header CF-Connecting-IP; ```

Common Cause 9: Different Headers per Location

Need different settings for different paths.

Solution: Set per location: ```nginx server { location /api { set_real_ip_from 10.0.0.0/8; real_ip_header X-Forwarded-For; proxy_pass http://backend; }

location /cdn-content { set_real_ip_from 173.245.48.0/20; # Cloudflare real_ip_header CF-Connecting-IP; root /var/www/html; } } ```

Verification

1.Add diagnostic headers:
2.```nginx
3.add_header X-Original-IP $remote_addr always;
4.add_header X-Forwarded-For-Original $http_x_forwarded_for always;
5.`
6.Test with curl:
7.```bash
8.# Test direct
9.curl -I http://your-server/test

# Test with spoofed header (should be ignored) curl -H "X-Forwarded-For: 8.8.8.8" -I http://your-server/test

# Test through proxy simulation curl -H "X-Forwarded-For: 203.0.113.50" -H "CF-Connecting-IP: 203.0.113.50" -I http://your-server/test ```

1.Check logs:
2.```nginx
3.log_format realip '$remote_addr - $http_x_forwarded_for - $http_cf_connecting_ip [$time_local]';
4.access_log /var/log/nginx/realip.log realip;
5.`

bash

tail -f /var/log/nginx/realip.log

1.Verify application receives correct IP:
2.```bash
3.curl http://your-server/api/whoami
4.# Should return your real IP, not proxy IP
5.`

Complete Working Configuration

```nginx # Cloudflare configuration set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 108.162.192.0/18; set_real_ip_from 131.0.72.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 162.158.0.0/15; set_real_ip_from 172.64.0.0/13; set_real_ip_from 173.245.48.0/20; set_real_ip_from 188.114.96.0/15; set_real_ip_from 190.93.240.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.0.0/17;

# IPv6 Cloudflare set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32;

real_ip_header CF-Connecting-IP; real_ip_recursive on;

server { listen 80; server_name example.com;

# Diagnostic headers (remove in production) add_header X-Real-IP $remote_addr always;

location / { proxy_pass http://backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ```

Verification

Issue	Cause	Fix
All requests same IP	Module not loaded	Load realip module
All requests same IP	Proxy not trusted	Add set_real_ip_from
Wrong IP detected	Wrong header	Use correct header for proxy
Chain IP issue	No recursive	Enable real_ip_recursive
Spoofed IPs accepted	No trusted list	Always set trusted proxies
IPv6 not detected	IPv6 CIDR missing	Add IPv6 proxy ranges
App sees wrong IP	App reads wrong header	Forward $remote_addr to backend

Real IP detection requires trusting specific proxies and using the correct header. Without proper configuration, either IPs are wrong (showing proxy IP) or spoofable (accepting any header value).

[Nginx troubleshooting: Fix Lambda Permission Denied - Complete ](fix-lambda-permission-denied)
[Nginx web server troubleshooting: Fix Client Max Body Size Large Upload Nginx Issue ](client-max-body-size-large-upload-nginx)
[Fix Apache 502 Proxy Error](fix-apache-502-proxy-error)
[Fix Apache LogLevel Core Debug Configuration](fix-apache-loglevel-core-debug)
[Fix Cloudflare 502 Bad Gateway Error](fix-cloudflare-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

Nginx Real IP Header Issues Nginx Real IP Header Issues Nginx Nginx Real IP Header Issues troubleshooting Nginx Real IP Header Issues fix Resolve Nginx real IP detection issues including wrong client IP, proxy header problems, and Cloudflare IP extraction failures Nginx Resolve Nginx real IP detection issues including wrong client IP, proxy header problems, and Cloudflare IP extraction failures

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

Nginx Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this nginx-errors troubleshooting guide applies to my situation?

This guide is designed for nginx-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these nginx-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of nginx-errors issue?

Most nginx-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this nginx-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for nginx-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Nov 28, 2025

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

How to Fix Nginx Real IP Header Issues

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Understanding Real IP Detection

Common Cause 1: Real IP Module Not Loaded

Common Cause 2: Proxy IP Not Trusted

Common Cause 3: Wrong Header Used

Common Cause 4: X-Forwarded-For Chain Issues

Common Cause 5: Multiple Proxies Not All Trusted

Common Cause 6: Header Spoofing Not Prevented

Common Cause 7: Application Not Using $remote_addr

Common Cause 8: Cloudflare IPv6 Not Trusted

Common Cause 9: Different Headers per Location

Verification

Complete Working Configuration

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

Nginx Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

How to Fix Nginx Real IP Header Issues

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Understanding Real IP Detection

Common Cause 1: Real IP Module Not Loaded

Common Cause 2: Proxy IP Not Trusted

Common Cause 3: Wrong Header Used

Common Cause 4: X-Forwarded-For Chain Issues

Common Cause 5: Multiple Proxies Not All Trusted

Common Cause 6: Header Spoofing Not Prevented

Common Cause 7: Application Not Using $remote_addr

Common Cause 8: Cloudflare IPv6 Not Trusted

Common Cause 9: Different Headers per Location

Verification

Complete Working Configuration

Verification

Related Articles

People also search for

Share this guide

More Nginx Troubleshooting Guides

Browse Guides from Other Categories

Nginx Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading