# How to set set\_real\_ip\_from for discourse

**URL:** https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416
**Category:** Support
**Created:** [November 20, 2017, 11:02am UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416 "2017-11-20T11:02:33Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![parisa](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@parisa](https://meta.discourse.org/u/parisa)
#### Post date: [November 20, 2017, 11:02am UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/1 "2017-11-20T11:02:33Z")

</div>

I want to do something like this in discourse:

```plaintext
    set_real_ip_from 127.0.0.1;
    set_real_ip_from 1.2.3.4;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

```

Normally I would do it in an nginx.conf file. However with discourse, I don’t know what to do. Can someone help me?

---

<div class="post-metadata">

### Author: ![Major](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@Major](https://meta.discourse.org/u/Major)
#### Post date: [November 20, 2017, 12:01pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/2 "2017-11-20T12:01:35Z")

</div>

I’ll write my solution I used earlier.

In the containers/app.yml  
See the templates that’re inserted  
Goto containers/templates  
Copy the name of the cloudflare.template.yml

Now edit the app.yml  
Insert

- “template/cloudflare.template.yml”

Save it, now  
./launcher app rebuild

---

<div class="post-metadata">

### Author: ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [November 20, 2017, 12:20pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/3 "2017-11-20T12:20:35Z")

</div>

Does this works with the set up where web sockets are used?

---

<div class="post-metadata">

### Author: ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [November 20, 2017, 12:26pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/4 "2017-11-20T12:26:39Z")

</div>

To be specific, my installation is running behind a nginx proxy as [described here](https://meta.discourse.org/t/adding-an-offline-page-when-rebuilding/45238)

is it possible to enable the cloudflare template?

---

<div class="post-metadata">

### Author: ![parisa](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@parisa](https://meta.discourse.org/u/parisa)
#### Post date: [November 20, 2017, 12:42pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/5 "2017-11-20T12:42:57Z")

</div>

> [@Major](#):
>
> Copy the name of the cloudflare.template.yml

Sorry but as far as I know its for cloudflare IPs. However, I have my own IP. And even if I would change this file for a little, I don’t know if my changes would be overwritten in future or not.

---

<div class="post-metadata">

### Author: ![parisa](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@parisa](https://meta.discourse.org/u/parisa)
#### Post date: [November 20, 2017, 10:12pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/6 "2017-11-20T22:12:42Z")

</div>

My use case is that I have a php file for login/sign-up using api calls and it is in one of my servers. Assuming that the public IP of that server is 1.2.3.4, all IPs inside discourse is reported to be also 1.2.3.4. And it would pass all limits very soon.

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 21, 2017, 3:55pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/7 "2017-11-21T15:55:31Z")

</div>

Not quite sure, but Google “nginx reverse proxy pass client ip”

---

<div class="post-metadata">

### Author: ![parisa](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@parisa](https://meta.discourse.org/u/parisa)
#### Post date: [November 21, 2017, 6:29pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/8 "2017-11-21T18:29:02Z")

</div>

> [@pfaffman](#):
>
> Google “nginx reverse proxy pass client ip”

I know about this part. I just don’t know how to implement it in discourse nginx. There is a template for cloudflare ips. but there is not a template for custom ips or any instructions, as far as I know.

---

<div class="post-metadata">

### Author: ![parisa](https://avatars.discourse-cdn.com/v4/letter/p/91b2a8/32.png) [@parisa](https://meta.discourse.org/u/parisa)
#### Post date: [November 22, 2017, 10:49am UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/9 "2017-11-22T10:49:32Z")

</div>

It seems I got it fixed by adding another template named customip.template.yml and adding it to app.yml.

I organized the content of the template like the following

```plaintext
run:
  - file:
      path: /tmp/add-custom-ips
      chmod: +x
      contents: |
        #!/bin/bash -e
        # Add list of custom ips
        echo "1.2.3.4" > /tmp/custom-ips
        # Make into nginx commands and escape for inclusion into sed append command
        CONTENTS=$(</tmp/custom-ips sed 's/^/set_real_ip_from /' | sed 's/$/;/' | tr '\n' '\\' | sed 's/\\/\\n/g')
        
        echo custom IPs:
        echo $(echo | sed "/^/a $CONTENTS")
        # Insert into discourse.conf
        sed -i "/sendfile on;/a $CONTENTS\nreal_ip_header X-Forwarded-For;\nreal_ip_recursive on;" /etc/nginx/conf.d/discourse.conf
        # Clean up
        rm /tmp/custom-ips

  - exec: "/tmp/add-custom-ips"
  - exec: "rm /tmp/add-custom-ips"

```

I don’t know to what extent my solution is correct and well organized. but it seems it just worked for me.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 22, 2017, 8:09pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/10 "2017-11-22T20:09:51Z")

</div>

Looks good to me, you highlight the **super important** fact there that you can not just trust any IP address with that header, cause if you did, user IPs can be spoofed.

An alternative I have seen (that we use in haproxy) is setting the IP only if we see some top secret header that we have the CDN always send us.

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 8, 2024, 12:43pm UTC](https://meta.discourse.org/t/how-to-set-set-real-ip-from-for-discourse/74416/11 "2024-06-08T12:43:51Z")

</div>

This topic was automatically closed after 2392 days. New replies are no longer allowed.