在一台服务器上使用上游时如何获得真实的客户端 IP？

Question

I have a vps running nginx, with ngx_stream_ssl_preread_module I have made SSL and Non-SSL protocols work on the same port. When I checked the access.log, I found a lot of lines starting with 127.0.0.1. Obviously this is not a real client IP.

I tried to modify my nginx.conf, such as proxy_set_header, real_ip_header, set_real_ip_from 127.0.0.1, etc.,they have no effect.

This is my origianl stream configuration in nginx.conf.

stream {
    server {
    listen 443;
    ssl_preread on;
        proxy_pass $upstream;
    }

    map $ssl_preread_protocol $upstream {
    default shadowsocks;
    "TLSv1.1" https;
    "TLSv1.2" https;
    "TLSv1.3" https;
    }

    upstream shadowsocks {
        server 127.0.0.1:7890;
    }

    upstream https {
        server 127.0.0.1:8888;
    }
}

Answer 1

I would try setting the proxy headers as follows:

server {
    listen 443 ssl default_server;
    ssl_preread on;

    proxy_redirect off;

    location / {
        proxy_set_header  Host $host;
        proxy_set_header  X-Real-IP $remote_addr;
        proxy_set_header  X-Forwarded-Proto https;
        proxy_set_header  X-Forwarded-For $remote_addr;
        proxy_set_header  X-Forwarded-Host $remote_addr;
        proxy_pass $upstream;
    }
}