Using Nginx to block IP's behind proxy
I'm running a Nginx 1.2.4 webserver here, and I'm behind a proxy of my hoster to prevent ddos attacks. The downside of being behind this proxy is that I need to get the REAL IP information from an extra header. In PHP it works great by doing $_SERVER[HTTP_X_REAL_IP] for example.
Now before I was behind this proxy of my hoster I had a very effective way of blocking certain IP's by doing this: include /etc/nginx/block.conf and to allow/deny IP's there.
But now due to the proxy, Nginx sees all traffic coming from 1 IP.
I have configurated Nginx with --with-http_realip_module so I should now be able to get the real IP's from people.
In my nginx.conf I have added:
real_ip_header X-Forwarded-For;
include blockips.conf;
I have also tried:
real_ip_header X-Real-IP;
include blockips.conf;
In both cases IP's listed in blockips.conf are not being blocked. Also in my log files I do not see the real ip's, but only the proxy IP show up.
What am I doing wrong?
Answer
I solved it.
Had to add:
set_real_ip_from 0.0.0.0;
Where IP 0.0.0.0 being the proxy