1

I am trying to config a reverse proxy server to call a third party, our access is limited to special Ip but when I call the proxy server the server pass client Ip to third party server.

I tried to fetch Ip addresses with a spring application and I got that spring getRemoteAddr is using something else than X-Forwarded-For.

I am looking for a way to get manipulated Ip in HttpServletRequest.getRemoteAddr()

Nginx config:

server {
    listen      80;
    server_name _;

    location / {
        real_ip_header X-Forwarded-For;
        proxy_set_header  X-Forwarded-For '192.168.1.1';   
        proxy_set_header X-Real-IP '192.168.1.1'; 
        proxy_pass http://192.168.30.31:8080;
    }

}

Spring Controller: 

@RestController
public class TestController {

    @RequestMapping("/")
    public String getIp(HttpServletRequest request) {
        return "getRemoteAddr: " + request.getRemoteAddr() +
                "\ngetRemoteHost: " + request.getRemoteHost() +
                "\nX-Forwarded-For: " + request.getHeader("X-Forwarded-For");
    }

}

Result

getRemoteAddr: 192.168.99.219 //expected 192.168.1.1
getRemoteHost: 192.168.99.219
X-Forwarded-For: 192.168.1.1
Mojtaba Yeganeh
  • 2,788
  • 1
  • 30
  • 49
  • 1
    Hey @Mojtabye, I have zero experience in using Java or Spring by any means. But I googled around a little bit and found out that you might need to manipulate some other http headers as well as `X-Forwarded-For`. Checkout these threads and see if you can find your answer: https://stackoverflow.com/a/54256268/3037529, https://stackoverflow.com/questions/7445592/what-is-the-difference-between-http-client-ip-and-http-x-forwarded-for/7446010#7446010 – nima Mar 05 '20 at 10:08
  • 1
    @nima Thanks, the problem is the server-side application is a third party and I can not change it! – Mojtaba Yeganeh Mar 05 '20 at 12:04
  • According to my understanding, you are currently setting `X-Forwarder-For` header in the `nginx` manually. I was suggesting you do the same thing for other headers such as `Proxy-Client-IP`, `HTTP_CLIENT_IP`, `HTTP_X_FORWARDED_FOR` as well. Because `request.getRemoteAddr()` is probably using one of those to retrieve client's IP. – nima Mar 05 '20 at 14:15

0 Answers0