The discussion revolves around nhumrich reporting that user IPs are showing up as the load balancer IP in Discourse, despite sending X-Forwarded-For headers from an external load balancer (AWS ELB). mpalmer suggests that the issue is due to a missing nginx setting to “trust” the IP address making the connection. The solution is to add real_ip_header X-Forwarded-For; and set_real_ip_from to the http section in nginx.conf. However, mpalmer cautions against setting set_real_ip_from to 0.0.0.0/0, as it allows IP spoofing, and recommends setting it to the IP range of the VPC instead. nhumrich acknowledges this, and mpalmer emphasizes the importance of this correction for others who may find the topic and copy the example.
I have an external load balancer (aws ELB) directing traffic to my discourse server. I have verified the X-Forwarded-For headers are being sent, but for some reason all the user ips show up as the load balancer ip?
Is this a bug or is there some setting I am missing?
I know @mpalmer knows a lot about this. Any advice, Matt?
I’d say you’re missing the nginx setting to “trust” the IP address that is making the connection, so the XFF header is ignored. The setting name is set_real_ip_from; grovel around in your nginx config(s) to see what (if anything) it’s currently set to, and season to taste.
Thanks, found the solution here: Amazon Elastic Load Balancer and Forwarding Real-IP Nginx
basically, add the following to the http section in nginx.conf
real_ip_header X-Forwarded-For;
set_real_ip_from 0.0.0.0/0;
Oh sweet jeebers, don’t do that. It’ll allow anyone who can manage to get a HTTP connection into your servers to spoof their IP address, which will only lead to trouble. Set it to the IP range of your VPC, instead.
oh ya, I know that much, I just didnt want to post my range to the public 
Sure, but will everyone else who finds this topic and copies your example know that?
Well, they’ll surely scroll down and see your reply just under it, though? I suspect yes.
That’s why I made my reply.