[PPPM-2672] How set nginx to show real IP?

[Azurel]

Is here a tutorial special for plesk 12 that show me how set nginx to show real visitor ip in access_log and php?

Actual nginx show for IPv6 visitors the own server IPv6 in access_log and php. Thats very annoying!

 

[IgorG]

Actually special modules for this purpose should be enabled by default in Apache - mod_rpaf (for Apache 2.2) or mod_remoteip (for Apache 2.4)
So, all should works as expected for IPv4 by default, but I'm not sure that there is the same behaviour for IPv6.
Please make sure that this module is loaded and all works fine for IPv4 addresses.

 

[Azurel]

My Plesk12 with apache 2.2 have in "Apache Web Server Settings" no module for "mod_rpaf". IPv4 working fine! I speak for IPv6.

nginx with IPv4 is correct set in /etc/nginx/plesk.conf.d/server.conf

server {
listen xx.xx.xx.xx:80;
location / {
proxy_pass http://xx.xx.xx.xx:7080;
}
}

but for IPv6

server {
listen [2a01:xx:xx:xx......]:80 ipv6only=on;
location / {
proxy_pass http://127.0.0.1:7080;
}
}

 

[IgorG]

Looks like some problems with IPv6.
BTW, we have checked this issue on Plesk 12.1 and all works fine there.

 

[Azurel]

Actual is plesk 12.0.18. What means all working fine in 12.1? Is the config in nginx now different? Is "proxy_pass" set to ipv6 and not localhost anymore? When can I upgrade to 12.1?

What is with users that can not upgrade, how can I fix this issue with 12.0.18?

 

[RuslanT]

Hello Azurel,
The issue is not fixed yet in Plesk (it's internal id is PPPM-2672). You can temporary workaround it by changing "$ipAddress->proxyEscapedAddress" to "$ipAddress->escapedAddress" in custom templates (please note that it's recommended to remove such customization when this bug will be fixed).

[root@a10-52-53-101 ~]# mkdir /usr/local/psa/admin/conf/templates/custom

[root@a10-52-53-101 ~]# mkdir /usr/local/psa/admin/conf/templates/custom/server

[root@a10-52-53-101 ~]# cp /usr/local/psa/admin/conf/templates/default/server/nginxVhosts.php /usr/local/psa/admin/conf/templates/custom/server

[root@a10-52-53-101 ~]# diff --ignore-all-space /usr/local/psa/admin/conf/templates/default/server/nginxVhosts.php /usr/local/psa/admin/conf/templates/custom/server/nginxVhosts.php

30c30

<  proxy_pass https://<?php echo $ipAddress->proxyEscapedAddress . ':' . $OPT['backendPort']; ?>;

---

>  proxy_pass https://<?php echo $ipAddress->escapedAddress . ':' . $OPT['backendPort']; ?>;

32c32

<  proxy_pass http://<?php echo $ipAddress->proxyEscapedAddress . ':' . $OPT['backendPort']; ?>;

---

>  proxy_pass http://<?php echo $ipAddress->escapedAddress . ':' . $OPT['backendPort']; ?>;

[root@a10-52-53-101 ~]# mkdir /usr/local/psa/admin/conf/templates/custom/domain

[root@a10-52-53-101 ~]# mkdir /usr/local/psa/admin/conf/templates/custom/domain/service/

[root@a10-52-53-101 ~]# cp /usr/local/psa/admin/conf/templates/default/domain/service/proxy.php /usr/local/psa/admin/conf/templates/custom/domain/service/

[root@a10-52-53-101 ~]# diff /usr/local/psa/admin/conf/templates/default/domain/service/proxy.php /usr/local/psa/admin/conf/templates/custom/domain/service/proxy.php

8c8

<  proxy_pass https://<?php echo $OPT['ipAddress']->proxyEscapedAddress . ':' . $OPT['backendPort'] ?>;

---

>  proxy_pass https://<?php echo $OPT['ipAddress']->escapedAddress . ':' . $OPT['backendPort'] ?>;

10c10

<  proxy_pass http://<?php echo $OPT['ipAddress']->proxyEscapedAddress . ':' . $OPT['backendPort'] ?>;

---

>  proxy_pass http://<?php echo $OPT['ipAddress']->escapedAddress . ':' . $OPT['backendPort'] ?>;

[root@a10-52-53-101 ~]# /usr/local/psa/admin/sbin/httpdmng --reconfigure-all

 

[Stéphane Besuchet]

Hello,

I have trouble with this issue but the Plesk server is on version 12.5.30 Update #30 on Linux Debian 7.10‬.
On the vhosts templates, the correction has been applied with the patch for PPPM-2672. Unfortunately the proxy seems to communicate with Apache via the public IP not loopback as source in IPv6. The apache module mod_rpaf is only configured to have loopback adresses for the proxy (/etc/apache2/mods-enabled/rpaf.conf)

<IfModule rpaf_module>
    RPAFenable On

    # When enabled, take the incoming X-Host header and
    # update the virtualhost settings accordingly:
    RPAFsethostname On

    # Define which IP's are your frontend proxies that sends
    # the correct X-Forwarded-For headers:
    RPAFproxy_ips 127.0.0.1 ::1

    # Change the header name to parse from the default
    # X-Forwarded-For to something of your choice:
#   RPAFheader X-Real-IP
</IfModule>

I had to add my public IPv6 addresses on RPAproxy_ips in order to remplace the source ip adresse with the real remote ip adresses :

<IfModule rpaf_module>

    # Define which IP's are your frontend proxies that sends
    # the correct X-Forwarded-For headers:
    RPAFproxy_ips 127.0.0.1 ::1 2001::[...]:27 2001::[...]:28

</IfModule>

I'm quite sure that changing the vhost template back to something like this would also work :

proxy_pass https://<?php '[::1]:' . $OPT['backendPort']; ?>;

or

proxy_pass https://<?php '127.0.0.1:' . $OPT['backendPort']; ?>;

Is it a known new bug on you side ?
Thanks a lot,
Stéphane

 

[RuslanT]

Hello, Stéphane
as I see the bug is fixed in Plesk 12.5. Try to move /usr/local/psa/admin/conf/templates/custom/ folder somewhere and regenerate templates using # plesk sbin httpdmng --reconfigure-all

 

[Stéphane Besuchet]

Hello Ruslan,

I do not use custom templates, I tried to use them but $ipAddress->proxyEscapedAddress has the same value as $OPT['ipAddress']->escapedAddress which is the public IP, so it has no difference on the generated configuration. As I understand on your first post, this is normal.
Unfortunately using public IP in proxy_pass instead of loopback adresse does show the server IP instead of the real remote IP in Apache logs.
I found the trick to solve this issue by changing the rpaf Apache module configuration, but with the stantard configuration of Plesk on my server the remote IPv6 is the server public IPv6, even if PPPM-2672 is effectively solved.
I do not have this issue with IPv4 even if public IP is also used in proxy_pass.

Thanks,
Stéphane