# IP Spoofing Attack
**URL:** https://meta.discourse.org/t/ip-spoofing-attack/67890
**Category:** Support
**Created:** [August 11, 2017, 5:19pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890 "2017-08-11T17:19:55Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [August 11, 2017, 5:19pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/1 "2017-08-11T17:19:55Z")
Of late after an upgrade I’ve seen a whole bunch of errors in the logs like
`ActionDispatch::RemoteIp::IpSpoofAttackError (IP spoofing attack?! HTTP_CLIENT_IP="74.103.19.54" HTTP_X_FORWARDED_FOR="138.164.23.59, 46.166.148.34") /var/www/discourse/vendor/bundle/ruby/2.3.0/gems/actionpack-4.2.9/lib/action_dispatch/middleware/remote_ip.rb:125:in 'calculate_ip'`
I couldn’t find anything on the discussion forum so I googled it and found this:
[https://medium.com/@derwiki/rails-ip-spoofing-attack-97da8ee1c191](https://medium.com/@derwiki/rails-ip-spoofing-attack-97da8ee1c191)
Am wondering if cellphone users are being impacted by this Rails IP check and if there’s some way to turn it off for discourse?
---
### Author:  [@SidV](https://meta.discourse.org/u/SidV)
#### Post date: [August 23, 2017, 6:40pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/2 "2017-08-23T18:40:56Z")
Hello team.
I’ve got a lot of logs with this too:
What is about that?
I’ve got a user sending me mails because he can’t post in the forum.
He said that the forum says “an error occurs” and can’t post messages, or new threads ☹
This is connected with this error log? 🤔
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 24, 2017, 3:34am UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/3 "2017-08-24T03:34:15Z")
My guess is you have something configured incorrectly in your network stack for your Discourse instance? Are either of you doing any weird proxying, or anything deviating from the normal Discourse Docker setup?
---
### Author:  [@SidV](https://meta.discourse.org/u/SidV)
#### Post date: [August 24, 2017, 12:20pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/4 "2017-08-24T12:20:30Z")
> [@codinghorror](#):
>
> Are either of you doing any weird proxying, or anything deviating from the normal Discourse Docker setup?
The setup was based on _[this guide](https://meta.discourse.org/t/running-other-websites-on-the-same-machine-as-discourse/17247)_.
The server is setup with multiple Discourse installs running under a single Nginx instance with separate vhosts.
For reference each vhost takes this form:
```plaintext
server {
listen 80;
# change this
server_name my-discourse-site.com;
client_max_body_size 100M;
location / {
proxy_pass http://unix:/var/discourse/shared/ ***** /nginx.http.sock:;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
```
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [August 24, 2017, 4:06pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/5 "2017-08-24T16:06:24Z")
I don’t have any of that. Just a simple single instance discourse setup with a static IP behind a firewall with a port forwarding for http and https.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [August 24, 2017, 5:20pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/6 "2017-08-24T17:20:09Z")
It’s probably a client proxy adding `Client-IP:`, then nginx adds `X-Forwarded-For`, and rails takes a look and says “okay none of these agree, so I don’t know what to trust, so I may as well throw an error”.
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [August 25, 2017, 10:40pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/7 "2017-08-25T22:40:24Z")
So does that mean the users cant access the site or it’s just a warning to be ignored?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 26, 2017, 12:18am UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/8 "2017-08-26T00:18:27Z")
It means your networking setup is configured incorrectly, as far as Discourse goes.
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [August 28, 2017, 1:23pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/9 "2017-08-28T13:23:36Z")
Not sure that that means. It’s a standard hosted install using the Discourse install guide. Single server, single install. No proxying, just a standard NAT firewall with a HTTP/S port forwarding to the discourse VM.
Am wondering could be due to a proxy at the client end?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [August 28, 2017, 4:58pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/10 "2017-08-28T16:58:55Z")
You can do this:
`proxy_set_header Client-IP "";`
> **[Module ngx\_http\_proxy\_module](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header)**
>
> The ngx\_http\_proxy\_module module allows passing requests to another server.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [September 7, 2019, 2:30pm UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/11 "2019-09-07T14:30:46Z")
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [September 9, 2019, 6:14am UTC](https://meta.discourse.org/t/ip-spoofing-attack/67890/12 "2019-09-09T06:14:21Z")