Can't get original downstream IP when using the realip module

[Tom van Neerijnen]

I would like to use the realip module to transparently use functionality like allow rules while at the same time store the original $remote_addr. The below shows my config and the resulting curl:

$ cat default
server {
        server_name localhost;
        location / {
                set $real_remote_addr $remote_addr;
                echo real_remote_addr -> $real_remote_addr;
                set_real_ip_from   0.0.0.0/0;
                real_ip_header     X-Real-IP;
                echo remote_addr -> $remote_addr;
                echo X-Real-IP -> $http_x_real_ip;
        }
}
$ curl -H "X-Real-IP: 10.10.10.10" localhost
real_remote_addr -> 127.0.0.1
remote_addr -> 127.0.0.1
X-Real-IP -> 10.10.10.10

If I change the "set" clause realip behaves as expected but I loose the original ip.

$ cat default 
server {
        server_name localhost;
        location / {
                set $real_remote_addr "something else";
                echo real_remote_addr -> $real_remote_addr;
                set_real_ip_from   0.0.0.0/0;
                real_ip_header     X-Real-IP;
                echo remote_addr -> $remote_addr;
                echo X-Real-IP -> $http_x_real_ip;
        }
}
$ curl -H "X-Real-IP: 10.10.10.10" localhost
real_remote_addr -> something else
remote_addr -> 10.10.10.10
X-Real-IP -> 10.10.10.10

Is there any way to achieve what I'm trying to achieve? Is it expected that setting a variable from the $remote_addr breaks realip?

[Maxim Dounin]

The problem is that the $remote_addr variable value is cached on a first access (which happens before realip module is able to update remote address, as set_real_ip_from is specified at location level). Accessing the $remote_addr variable doesn't break realip though - the address as seen by nginx, e.g., by deny/allow directives, will be properly updated.

Not sure if it wroth fixing. Making $remote_addr uncacheable looks like an overkill for this particular edge case, and we currently have no mechanism in place to selectively flush cached variables. Normally, when realip is set on a server level, the address is updated before any other modules start to work, and this isn't a problem.

As for what are you trying to do - I tend to say that there is no good way to do this. The realip module is designed to completely replace the original address of a connection, and it doesn't try to make it accessible in any form.

[Maxim Dounin]

Just for the record: the $realip_remote_addr variable was added in nginx 1.9.7 to facilitate the original use case. There are no plans to change $remote_addr caching, so closing this.