HttpRealIpModule only seems to work with one trusted proxy, you can't build a list of trusted proxies as only the first one will work

[cwjam.com]

HttpRealIpModule only seems to work with the first trusted proxy set via set_real_ip_from.
Any additional trusted proxies are ignored which contradicts the example at ​http://wiki.nginx.org/HttpRealIpModule

Example 1:
If you only supply one trusted proxy everything works as expected.

set_real_ip_from proxy_1_IP;
real_ip_header X-Forwarded-For;

X-Forwarded-For: client1, proxy_1_IP
$remote_addr = client1 (which is expected)

Example 2:
However if you provide a list of trusted proxies, only the first one is applied.

set_real_ip_from proxy_1_IP;
set_real_ip_from proxy_2_IP;
real_ip_header X-Forwarded-For;

X-Forwarded-For: client1, proxy_2_IP, proxy_1_IP
$remote_addr = proxy_2_IP (which is unexpected)

It looks like I'm not the only person to encounter this issue:
​http://forum.nginx.org/read.php?2,154968,154996

The poster of that thread has supplied a patch (which I have not tested)
​http://treehou.se/~omar/nginx-0.8.53-xff.patch

Thanks,
Ciaran

[Maxim Dounin]

This is not a bug, realip module doesn't follow ip addresses chain but rather uses last one (in case of X-Forwarded-For). Wiki is plain wrong here, feel free to fix it. Please refer to original documentation (in Russian) for clear and unambigous description:

​http://sysoev.ru/nginx/docs/http/ngx_http_realip_module.html

I've reclassified this as an "enhancement" and leave it open for future review/work. The functionality itself likely be helpful in some setups, though I'm not sure I'm happy with the patch (at least, I would like to see this configurable and off by default, not unconditionally enabled).

[Joe Cai]

realip patch against nginx 1.0.12

[Ruslan Ermilov]

In [4625/nginx]:

realip: chains of trusted proxies and IPv6 support.

The module now supports recursive search of client address through
the chain of trusted proxies, controlled by the "real_ip_recursive"
directive (closes #2). It also gets full IPv6 support (closes #44)
and canonical value of the $client_addr variable on address change.

Example:

real_ip_header X-Forwarded-For;
set_real_ip_from 127.0.0.0/8;
set_real_ip_from ::1;
set_real_ip_from unix:;
real_ip_recursive on;

[Maxim Dounin]

In [4669/nginx]:

Merge of r4614, r4624-r4629, r4631: proxy recursive changes.

*) Added IPv6 and UNIX-domain socket support in "debug_connection"

directive.

*) New function ngx_http_get_forwarded_addr() to look up real client

address.

On input it takes an original address, string in the X-Forwarded-For format
and its length, list of trusted proxies, and a flag indicating to perform
the recursive search. On output it returns NGX_OK and the "deepest" valid
address in a chain, or NGX_DECLINED. It supports AF_INET and AF_INET6.
Additionally, original address and/or proxy may be specified as AF_UNIX.

*) Realip: chains of trusted proxies and IPv6 support.

The module now supports recursive search of client address through
the chain of trusted proxies, controlled by the "real_ip_recursive"
directive (closes #2). It also gets full IPv6 support (closes #44)
and canonical value of the $client_addr variable on address change.

Example:

real_ip_header X-Forwarded-For;
set_real_ip_from 127.0.0.0/8;
set_real_ip_from ::1;
set_real_ip_from unix:;
real_ip_recursive on;

*) Geo: chains of trusted proxies and partial IPv6 support.

The module now supports recursive search of client address through
the chain of trusted proxies, controlled by the "proxy_recursive"
directive in the "geo" block. It also gets partial IPv6 support:
now proxies may be specified with IPv6 addresses.

Example:

geo $test {

...
proxy 127.0.0.1;
proxy ::1;
proxy_recursive;

}

There's also a slight change in behavior. When original client
address (as specified by the "geo" directive) is one of the
trusted proxies, and the value of the X-Forwarded-For request
header cannot not be parsed as a valid address, an original client
address will be used for lookup. Previously, 255.255.255.255 was
used in this case.

*) Geoip: trusted proxies support and partial IPv6 support.

The module now supports recursive search of client address through the
chain of trusted proxies (closes #100), in the same scope as the geo
module. Proxies are listed by the "geoip_proxy" directive, recursive
search is enabled by the "geoip_proxy_recursive" directive. IPv6 is
partially supported: proxies may be specified with IPv6 addresses.

Example:

geoip_country .../GeoIP.dat;
geoip_proxy 127.0.0.1;
geoip_proxy ::1;
geoip_proxy 10.0.0.0/8;
geoip_proxy_recursive on;