# Real IP no longer recognized through proxy
**URL:** https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792
**Category:** Self-hosting
**Created:** [July 16, 2026, 1:02pm UTC](https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792 "2026-07-16T13:02:29Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@mcdanlj](https://meta.discourse.org/u/mcdanlj)
#### Post date: [July 16, 2026, 1:02pm UTC](https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792/1 "2026-07-16T13:02:29Z")
In the past couple of months (not sure exactly when this started), I’ve seen that my external nginx configuration, as documented in [Add an offline page to display when Discourse is rebuilding or starting up](https://meta.discourse.org/t/add-an-offline-page-to-display-when-discourse-is-rebuilding-or-starting-up/45238) , to pass through the real IP address is being ignored.
This external nginx configuration has worked for years:
```plaintext
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Real-IP $remote_addr;
```
Now I’m seeing all traffic attributed to the internal docker network in RFC1918 space, like so:
This is obviously breaking the “apply this penalty to other users sharing this IP address” and all other uses of the real remote IP address.
I expect this has been addressed somewhere and I am just searching poorly. ☹ But I’d appreciate pointers on what might have changed, to which I need to adapt.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 16, 2026, 1:27pm UTC](https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792/2 "2026-07-16T13:27:43Z")
I remember something about this recently but I can’t find it either. [Handling the "chain of trust" of the end user's real IP - #8 by supermathie](https://meta.discourse.org/t/handling-the-chain-of-trust-of-the-end-users-real-ip/406372/8) includes a link to the cloudflare template, which I think may be a good model.
>
Here’s what I’m doing and it seems to still work (as of “Discourse 2026.6.0-latest - [GitHub - discourse/discourse: A platform for community discussion. Free, open, simple. · GitHub](https://github.com/discourse/discourse) version 5c507d8359f4d6e8a5d98780c622d51cedbd9bd7”)
```plaintext
after_bundle_exec:
- replace:
filename: /etc/nginx/conf.d/discourse.conf
from: "types {"
to: |
set_real_ip_from 192.168.1.0/24;
set_real_ip_from 192.168.11.0/24;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 10.0.0.0/8;
real_ip_recursive on;
real_ip_header X-Forwarded-For;
types {
```
---
### Author:  [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [July 16, 2026, 2:39pm UTC](https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792/3 "2026-07-16T14:39:50Z")
Probably related to this commit: [FIX: nginx sample configuration should be setting x-f-f to the end us… · discourse/discourse@b4a3389 · GitHub](https://github.com/discourse/discourse/commit/b4a3389751ebe118f58ec6dd5419d6007c61228f)
This may help you:
> [@Handling the "chain of trust" of the end user's real IP](https://meta.discourse.org/t/handling-the-chain-of-trust-of-the-end-users-real-ip/406372):
>
> Background Discourse needs to be aware of the end user’s real IP address. However, an end user never directly connects to Discourse since there is always one or more upstream web servers (nginx running in the Discourse container) in place. Thus, we need a way to pass along that information to Discourse in a trusted manner. The x-forwarded-for header is the solution. In this topic I will describe the specific mechanisms for properly handling that information and how we’re expecting it to be pro…
---
### Author:  [@mcdanlj](https://meta.discourse.org/u/mcdanlj)
#### Post date: [July 16, 2026, 3:16pm UTC](https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792/4 "2026-07-16T15:16:04Z")
As usual, posting it and seeing responses helps me find other similar posts. 🤣 e.g.
> [@Last IP shows Reverse Proxy IP address](https://meta.discourse.org/t/last-ip-shows-reverse-proxy-ip-address/113032):
>
> Hi, I have researched quite a lot but nothing seems to work with me. I have a discourse setup installed. And I have this remote reverse proxy server that acts as a HTTPS layer between the user and the main discourse server.. I have included these revers proxy settings properly.. But why does it still show my Reverse Proxy server’s IP Address (hostname to be specific)
Thanks y’all! Off to configure `set_real_ip_from` in the container nginx!
I’m going to do the entire RFC1918 space though. For anyone else’s reference, that would be:
```plaintext
after_bundle_exec:
- replace:
filename: /etc/nginx/conf.d/discourse.conf
from: "types {"
to: |
set_real_ip_from 192.168.0.0/16;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 10.0.0.0/8;
real_ip_recursive on;
real_ip_header X-Forwarded-For;
types {
```
---
### Author:  [@mcdanlj](https://meta.discourse.org/u/mcdanlj)
#### Post date: [July 16, 2026, 5:07pm UTC](https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792/5 "2026-07-16T17:07:03Z")
> [@pfaffman](#):
>
> Here’s what I’m doing and it seems to still work
That’s not working for me.
I now understand why it quit working for me from the referenced commit; it broke the `set_real_ip` replace that I’d had in place for years. The rationale of making it more robust is sane, and this is a better route; one breaking change and then should break less in the future.
I don’t know why the `after_bundle_exec` replace isn’t applying, but I’m going to switch to dropping in files.
This works for me; sharing for the next person:
```plaintext
run:
- file:
path: /etc/nginx/conf.d/outlets/server/real-ip-recursive.conf
chmod: 644
contents: |
real_ip_recursive on;
- file:
path: /etc/nginx/conf.d/outlets/server/real-ip-header.conf
chmod: 644
contents: |
real_ip_header X-Forwarded-For;
- file:
path: /etc/nginx/conf.d/outlets/server/set-real-ip-from.conf
chmod: 644
contents: |
set_real_ip_from 192.168.0.0/16;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 10.0.0.0/8;
```
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [August 15, 2026, 5:07pm UTC](https://meta.discourse.org/t/real-ip-no-longer-recognized-through-proxy/407792/6 "2026-08-15T17:07:29Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.