# Discourse reports user ips as the load balancer
**URL:** https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049
**Category:** Development
**Created:** [May 31, 2016, 5:51pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049 "2016-05-31T17:51:17Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@nhumrich](https://meta.discourse.org/u/nhumrich)
#### Post date: [May 31, 2016, 5:51pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/1 "2016-05-31T17:51:17Z")
I have an external load balancer (aws ELB) directing traffic to my discourse server. I have verified the `X-Forwarded-For` headers are being sent, but for some reason all the user ips show up as the load balancer ip?
Is this a bug or is there some setting I am missing?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 31, 2016, 6:16pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/2 "2016-05-31T18:16:01Z")
I know @mpalmer knows a lot about this. Any advice, Matt?
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [May 31, 2016, 10:54pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/3 "2016-05-31T22:54:47Z")
I’d say you’re missing the nginx setting to “trust” the IP address that is making the connection, so the XFF header is ignored. The setting name is `set_real_ip_from`; grovel around in your nginx config(s) to see what (if anything) it’s currently set to, and season to taste.
---
### Author:  [@nhumrich](https://meta.discourse.org/u/nhumrich)
#### Post date: [June 1, 2016, 4:37pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/4 "2016-06-01T16:37:25Z")
Thanks, found the solution here: [Amazon Elastic Load Balancer and Forwarding Real-IP Nginx](https://easyengine.io/tutorials/nginx/amazon-elastic-load-balancer-forward-real-ip/)
basically, add the following to the http section in nginx.conf
```
real_ip_header X-Forwarded-For;
set_real_ip_from 0.0.0.0/0;
```
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [June 1, 2016, 10:49pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/5 "2016-06-01T22:49:47Z")
> [@nhumrich](#):
>
> set\_real\_ip\_from 0.0.0.0/0;
Oh sweet jeebers, don’t do that. It’ll allow anyone who can manage to get a HTTP connection into your servers to spoof their IP address, which will only lead to trouble. Set it to the IP range of your VPC, instead.
---
### Author:  [@nhumrich](https://meta.discourse.org/u/nhumrich)
#### Post date: [June 1, 2016, 11:33pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/6 "2016-06-01T23:33:18Z")
oh ya, I know that much, I just didnt want to post my range to the public 😉
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [June 1, 2016, 11:54pm UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/7 "2016-06-01T23:54:57Z")
Sure, but will everyone _else_ who finds this topic and copies your example know that?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [June 2, 2016, 12:12am UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/8 "2016-06-02T00:12:18Z")
Well, they’ll surely scroll down and see your reply just under it, though? I suspect yes.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [June 2, 2016, 12:13am UTC](https://meta.discourse.org/t/discourse-reports-user-ips-as-the-load-balancer/45049/9 "2016-06-02T00:13:13Z")
That’s why I made my reply.