Nginx: Log client ip behind NAT with http_x_forwarded_for (X-Forwarded-For Header)

Use nginx real_ip module

nginx -V | grep with-http_realip_module

# /etc/nginx/nginx.conf
...
http {
    ...
    # set_real_ip_from 0.0.0.0/0;
    set_real_ip_from x.x.x.x/x; # LB subnet
    real_ip_header X-Forwarded-For;
    ...
}
...

Option 2: customize log_format

cat /etc/nginx/nginx.conf
...
log_format  main  '$http_x_forwarded_for - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log main;
...

Reload Nginx configuration

service nginx reload

Links
http://www.loadbalancer.org/blog/nginx-and-x-forwarded-for-header/
https://serverfault.com/questions/729128/overriding-nginx-access-log-directive-duplicate-log-entries
http://nginx.org/en/docs/http/ngx_http_log_module.html
https://www.nginx.com/resources/wiki/start/topics/examples/full/

Nginx (proxy) Docker container

Create required directories

mkdir -p /etc/docker/nginx/{conf.d,html}

Configure nginx as webserver

cat < /etc/docker/nginx/conf.d/default.conf
server {
    listen 80;
    server_name _;

    root   /usr/share/nginx/html; 
    index  index.html index.htm;
}
EOF

Configure nginx as proxy

cat < /etc/docker/nginx/conf.d/proxy.conf
server {
    listen 80;
    server_name foo.example.com;

    location / {
        proxy_pass http://localhost:8080/;
    }
}
EOF

Create container

sudo docker run -d \
  --name nginx \
  --net host \
  -v /etc/docker/nginx/html:/usr/share/nginx/html:ro \
  -v /etc/docker/nginx/conf.d:/etc/nginx/conf.d:ro \
  nginx

debug

docker restart nginx
docker logs nginx -f

Links
https://hub.docker.com/_/nginx

Nginx access control / GeoIP 

cat < /etc/nginx/conf.d/geoip.conf 
geoip_country /usr/share/GeoIP/GeoIP.dat;

map $geoip_country_code $allowed_country {
    default no;
    DE yes;
    CH yes;
}

log_format allow "allow $remote_addr;";
EOF
chmod 644 /etc/nginx/conf.d/geoip.conf


cat < /usr/local/bin/nginx-allow
#!/bin/bash

while inotifywait --quiet --event create,delete --exclude "[^c][^o][^n][^f]$" /tmp
do
    /usr/sbin/nginx -t && /usr/sbin/service nginx reload
done
EOF
chmod 755 /usr/local/bin/nginx-allow


cat < /etc/systemd/system/nginx-allow.service
[Unit]
Description=Nginx configuration monitor service
After=nginx.service

[Service]
Type=simple
ExecStart=/usr/local/bin/nginx-allow
Restart=on-abort

[Install]
WantedBy=multi-user.target
EOF
chmod 644 /etc/systemd/system/nginx-allow.service


systemctl daemon-reload
systemctl enable nginx-allow.service 
systemctl start nginx-allow.service 



cat < /etc/cron.hourly/clean_nginx_allow
#!/bin/bash

find /tmp -ctime +2 -name nginx_allow_*.conf -delete
EOF


cat /etc/nginx/sites-available/nginx-allow
...
set $backend $scheme://10.0.10.101;
error_page 403 =404 /404.gif;

location /nginx-allow/ {
    if ($allowed_country = yes) {
        access_log /tmp/nginx_allow_$remote_addr.conf allow;
        proxy_pass $backend;
    }

    proxy_pass $backend/404.html;
}

location ~ ^(/wp-admin|/admin) {
    include /tmp/nginx_allow_*.conf;
    deny all;

    proxy_pass $backend;
}
...

cat < /root/bin/nginx_allow_ddns.sh
#!/bin/bash -e

DDNS=foo.dyndns.com

sleep 3

IP=$(getent hosts ${DDNS} | cut -d" " -f1)
[ -n ${IP} ] && echo "allow ${IP};" > /tmp/nginx_allow_${IP}.conf

service nginx reload
EOF

# crontab -e
@reboot /root/bin/nginx_allow_ddns.sh

Links
https://docs.nginx.com/nginx/admin-guide/mail-proxy/mail-proxy/
https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-by-geoip/

nginx

List available modules

nginx -V

SSL

cp *.crt /etc/ssl/certs/
cp *.key /etc/ssl/private/
service nginx restart

Sites

# cat /etc/nginx/sites-enabled/default 
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    server_name _;
    location / {
        proxy_pass http://127.0.0.1:4440;
    }
}

# /etc/nginx/sites-available/www.example.com.conf
server {
    server_name www.example.com;
    listen 443 ssl;

    root /usr/share/nginx/www/;

    ssl_certificate      /etc/ssl/certs/example.com.pem;
    ssl_certificate_key  /etc/ssl/private/example.com.key;

    sub_filter_once off;
    sub_filter "Welcome" "Sello";
}

server {
    server_name www.example.com;
    listen 80;

    root /usr/share/nginx/www/;

    access_log /var/log/nginx/access_www.example.com.log;
    error_log /var/log/nginx/error_www.example.com.log debug;

    sub_filter_once off;
    sub_filter "Welcome" "Hello";
}

Options

# allow body size / upload up to 10 MB
http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
client_max_body_size 10M;

<strong>Snippets</strong>
location /foo {
    if ( $request_method != 'POST' ) {
        return 400;
    }
}

Configuration

service nginx configtest

# disable cache
location stuffyoudontwanttocache {
    proxy_no_cache 1; # don't cache it
    proxy_cache_bypass 1; # even if cached, don't try to use it
}
#    expires 1s;

# redirect to https
if ($ssl_protocol = "") {
    return 301 https://$server_name$request_uri;
}

# directory listing / autoindex
https://www.keycdn.com/support/nginx-directory-index/
server {
   ...
    location / {
        autoindex on;
    ...
    }
   ...
}

https://www.nginx.com/resources/wiki/modules/fancy_index/
https://github.com/aperezdc/ngx-fancyindex

nginx