# Last IP address and action\_dispatch.trusted\_proxies **URL:** \ **Category:** Support\ **Created:** [2016年九月13日 17:50 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098 "2016-09-13T17:50:59Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![dorian\_kind](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dorian_kind/32/115240_2.png) [@dorian\_kind](https://meta.discourse.org/u/dorian_kind)\ **Post date:** [2016年九月13日 17:50 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/1 "2016-09-13T17:50:59Z")
I’m experiencing the problem that all of our users have `127.0.0.1` as last IP address. This issue was previously discussed [here](https://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0ahUKEwi4quut8IzPAhXEPRQKHaikBcMQFggcMAA&url=https%3A%2F%2Fmeta.discourse.org%2Ft%2Fall-of-my-internal-users-show-as-coming-from-127-0-0-1%2F6607&usg=AFQjCNFaUe8nR4por5HWC-Y3mpJcPx-mpA&sig2=9a9nKZ-eVVr0pd_7qBgG6g&bvm=bv.132479545,d.bGg&cad=rja), [here](https://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0ahUKEwi4quut8IzPAhXEPRQKHaikBcMQFggiMAE&url=https%3A%2F%2Fmeta.discourse.org%2Ft%2Flast-ip-address-always-127-0-0-1%2F31894&usg=AFQjCNEleqtpimlM9pIJZozZBksEE6fhww&sig2=xNyHkQzq_392qcQwwQL6lA&bvm=bv.132479545,d.bGg&cad=rja) and [here](https://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0ahUKEwi4quut8IzPAhXEPRQKHaikBcMQFggoMAI&url=https%3A%2F%2Fmeta.discourse.org%2Ft%2Fwhen-all-users-come-from-127-0-0-1-new-registrations-are-blocked%2F29533&usg=AFQjCNFyObczMTx30OCzlO0iJo1my8wRZw&sig2=7HX71niLWrMMee_TWl_54Q&bvm=bv.132479545,d.bGg&cad=rja), and all of these threads contain valuable input, but I still cannot get it to work. Our setup is an internal Discourse installation (Docker) behind an internal SSL-proxy. All our users also access Discourse from our internal network (directly or via VPN). When I `tcpdump` a packet from Discourse’s `nginx` to the Rails app, I see the following: > ``` > GET / HTTP/1.0 > Host: > X-Real-IP: 10.10.2.3 > X-Forwarded-For: 10.10.0.89, 10.10.2.3 > X-Forwarded-Proto: https > Connection: close > Cache-Control: max-age=0 > > ``` This is correct as the SSL proxy is `10.10.2.3` and the client’s IP address is `10.10.0.89`. Now the way I understand that the responsible middleware in Rails works is that it removes all IPs from the `X-Forwarded-For` list that seem to be proxies. The default list `TRUSTED_PROXIES` includes all private IP network ranges, thus leaving no IP left and going with `127.0.0.1` as the default (because of `REMOTE_ADDR` coming from Discourse’s `nginx`). I have modified `config/application.rb` to include > ``` > config.action_dispatch.trusted_proxies = %w(127.0.0.1/32 10.10.2.3/32).map { |proxy| IPAddr.new(proxy) } > > ``` and restarted the docker container. This seems to have the desired effect at first. When I run a Rails console inside the app, I see the following: > ``` > rails c production > Loading production environment (Rails 4.2.7) > irb(main):001:0> app.get '/' > Started GET "/" for 127.0.0.1 at 2016-09-13 17:45:09 +0000 > Processing by CategoriesController#index as HTML > Redirected to http://www.example.com/login > Filter chain halted as :redirect_to_login_if_required rendered or redirected > Completed 302 Found in 68ms (ActiveRecord: 13.0ms) > => 302 > irb(main):002:0> app.request.env['action_dispatch.remote_ip'].instance_variable_get :@proxies > => [#, #] > irb(main):003:0> > > ``` So it seems that the `RemoteIp` middleware now uses the right IP addresses as a proxy list. **However** , I still only see `127.0.0.1` as last IP address for our users. Don’t really know what else to do—if anyone can shed some light on the behavior, I’d appreciate it. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2016年九月13日 22:07 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/2 "2016-09-13T22:07:09Z")
Any ideas here @mpalmer? ---
**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\ **Post date:** [2016年九月13日 23:43 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/3 "2016-09-13T23:43:57Z")
We don’t use trusted\_proxies in our hosted environment; we adjust the nginx config to set `X-Real-IP` directly, since, IIRC, the `RemoteIp` middleware prefers that over XFF. The pups exec stanza we use looks like this: ``` - replace: filename: /etc/nginx/conf.d/discourse.conf from: "types {" to: | set_real_ip_from 10.0.0.0/24; set_real_ip_from 172.17.0.0/24; real_ip_header X-Forwarded-For; real_ip_recursive on; types { ``` ---
**Author:** ![dorian\_kind](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dorian_kind/32/115240_2.png) [@dorian\_kind](https://meta.discourse.org/u/dorian_kind)\ **Post date:** [2016年九月14日 15:52 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/4 "2016-09-14T15:52:07Z")
Thanks for your feedback! I’m not sure if this specific workaround would help in our case, as all IPs involved are in `10.0.0.0/16` and would still be in `RemoteIp`’s `TRUSTED_PROXIES` list. Here’s the [relevant code](https://github.com/rails/rails/blob/4-2-stable/actionpack/lib/action_dispatch/middleware/remote_ip.rb#L130) from Rails 4.2. Interestingly, `X-Real-IP` doesn’t appear anywhere there, only `X-Forwarded-For` and `Client-Ip`: > ``` > # We assume these things about the IP headers: > # > # - X-Forwarded-For will be a list of IPs, one per proxy, or blank > # - Client-Ip is propagated from the outermost proxy, or is blank > # - REMOTE_ADDR will be the IP that made the request to Rack > ips = [forwarded_ips, client_ips, remote_addr].flatten.compact > > ``` > ``` > # If every single IP option is in the trusted list, just return REMOTE_ADDR > filter_proxies(ips).first || remote_addr > > ``` If I understand it correctly, `filter_proxies` removes all IP address from `ips` that are in `TRUSTED_PROXIES `, no matter whether they originally came from `X-Forwarded-For` or `Client-Ip`. So we would still end up with `remote_addr`, which will always be `127.0.0.1` I do realize that this probably more of a Rack/Rails topic than a Discourse one. But maybe someone else has a similar setup and managed to have the proper last IP addresses displayed in the admin interface. ---
**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\ **Post date:** [2016年九月14日 20:24 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/5 "2016-09-14T20:24:55Z")
You might need to remove some address ranges from `TRUSTED_PROXIES`, by the sound of it. ---
**Author:** ![dorian\_kind](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dorian_kind/32/115240_2.png) [@dorian\_kind](https://meta.discourse.org/u/dorian_kind)\ **Post date:** [2016年九月15日 15:50 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/6 "2016-09-15T15:50:43Z")
I completely agree, that’s what I’m trying to do (see above) by setting `config.action_dispatch.trusted_proxies` in `config/application.rb`—its default value is `TRUSTED_PROXIES`. But for some reason this does not have the desired effect. ---
**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\ **Post date:** [2016年九月15日 22:06 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/7 "2016-09-15T22:06:34Z")
Does that setting perhaps add to `TRUSTED_PROXIES`, rather than override it? ---
**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\ **Post date:** [2019年三月6日 18:22 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/8 "2019-03-06T18:22:43Z")
---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2019年三月7日 01:01 UTC](https://meta.discourse.org/t/last-ip-address-and-action-dispatch-trusted-proxies/50098/9 "2019-03-07T01:01:02Z")