{"id":407,"date":"2013-04-11T00:32:57","date_gmt":"2013-04-10T23:32:57","guid":{"rendered":"http:\/\/tech.moosaico.com\/blog\/?p=407"},"modified":"2013-04-15T12:25:07","modified_gmt":"2013-04-15T11:25:07","slug":"how-to-get-the-original-ip-address-in-apache2-behind-nginx","status":"publish","type":"post","link":"https:\/\/thejoyofstick.com\/blog\/2013\/04\/11\/how-to-get-the-original-ip-address-in-apache2-behind-nginx\/","title":{"rendered":"How to get the original IP address in Apache2 behind Nginx"},"content":{"rendered":"<h2>Nginx as a reverse proxy for Apache<\/h2>\n<p>A traditional setup is having <a href=\"http:\/\/nginx.com\" title=\"Nginx\" target=\"_blank\">Nginx<\/a> as a frontend and then running <a href=\"http:\/\/httpd.apache.org\/\" title=\"Apache2\" target=\"_blank\">Apache<\/a> through reverse proxy. The Apache logs become full of just a single IP address, the accesses from the Nginx server &#8211; usually 127.0.0.1 if you are running both on the same server.<\/p>\n<p>No more GeoIP decisions on the backend or any other feature by remote address.<\/p>\n<p>But we know that Nginx passes along the original client IP address on a HTTP header named <code>X-Forwarded-For<\/code> to the backend server. It would be awesome if Apache could deal with that,<\/p>\n<h2>Have no fear, Reverse Proxy Add Forward is here!<\/h2>\n<p>Fortunately there is already a module that injects the IP on a special header to the HTTP request to Apache: <code>mod_rpaf<\/code><\/p>\n<p>The installation couldn&#8217;t be more simple than<\/p>\n<pre lang=\"linux\">\r\n$ sudo apt-get install libapache2-mod-rpaf\r\n<\/pre>\n<p>It will enabled it automatically<\/p>\n<pre lang=\"linux\">\r\n\/etc\/apache2\/mods-enabled\/rpaf.conf\r\n\/etc\/apache2\/mods-enabled\/rpaf.load\r\n<\/pre>\n<p>In Nginx I usually include <code>\/etc\/nginx\/proxy.conf<\/code> in my configuration. It already has these lines to help that everything works easily<\/p>\n<pre lang=\"linux\">\r\nproxy_set_header    Host            $host;\r\nproxy_set_header    X-Real-IP       $remote_addr;\r\nproxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;\r\n<\/pre>\n<p>Just restart the Apache server<\/p>\n<pre lang=\"linux\">\r\n$ sudo service apache2 restart\r\n<\/pre>\n<h2>But there&#8217;s a problem<\/h2>\n<p>Unfortunately it won&#8217;t work if you are using Ubuntu 12.04.<\/p>\n<p><strong><code>mod_rpaf<\/code> is not working on Precise !<\/strong><\/p>\n<p>There is a bug with the package that is known to Canonical since last December as you can see in the <a href=\"https:\/\/bugs.launchpad.net\/ubuntu\/+source\/libapache2-mod-rpaf\/+bug\/930540\" title=\"libapache2-mod-rpaf\">bug track<\/a>. Being a LTS version I  don&#8217;t understand this attitude from them.<\/p>\n<pre lang=\"linux\">\r\n$ cat \/etc\/apache2\/mods-enabled\/rpaf.conf \r\n<IfModule mod_rpaf.c>\r\nRPAFenable On\r\nRPAFsethostname On\r\nRPAFproxy_ips 127.0.0.1 ::1\r\n<\/IfModule>\r\n<\/pre>\n<p>And the problem is that it is originally named <code>mod_rpaf-2.0.c<\/code>.<\/p>\n<pre lang=\"linux\">\r\n$ strings \/usr\/lib\/apache2\/modules\/mod_rpaf.so | grep mod_rpaf\r\nmod_rpaf.so\r\nmod_rpaf-2.0.c\r\nEnable mod_rpaf\r\nLet mod_rpaf set the hostname from X-Host header and update vhosts\r\n<\/pre>\n<p>Just edit the first line of <code>\/etc\/apache2\/mods-enabled\/rpaf.conf<\/code> and change it to<\/p>\n<pre lang=\"linux\">\r\n<IfModule rpaf_module>\r\n<\/pre>\n<p>Restart again the Apache2 server and you will start to get all those remote IPs on your log files.<\/p>\n<h2>Conclusion<\/h2>\n<p>If it was not for the known bug this post could have been just one line to install <code>mod_rpaf<\/code><\/p>\n<p>:-)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Nginx as a reverse proxy for Apache A traditional setup is having Nginx as a frontend and then running Apache through reverse proxy. The Apache logs become full of just a single IP address, the accesses from the Nginx server&hellip; <a href=\"https:\/\/thejoyofstick.com\/blog\/2013\/04\/11\/how-to-get-the-original-ip-address-in-apache2-behind-nginx\/\" class=\"more-link\">Continue Reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[62,61,59,60],"class_list":["post-407","post","type-post","status-publish","format-standard","hentry","category-ubuntu","tag-apache2","tag-bug","tag-nginx","tag-reverse-proxy"],"jetpack_shortlink":"https:\/\/wp.me\/pcmwlL-6z","jetpack_sharing_enabled":true,"jetpack_likes_enabled":false,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts\/407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/comments?post=407"}],"version-history":[{"count":26,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts\/407\/revisions"}],"predecessor-version":[{"id":438,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts\/407\/revisions\/438"}],"wp:attachment":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/media?parent=407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/categories?post=407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/tags?post=407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}