Server receiving hit from this IP Address "::ffff:127.0.0.1". Why is that and how to resolve this?

April 28, 2017 7.8k views
Nginx JavaScript Node.js IPv6
ok91
By:
ok91

I have a MEAN Stack application deployed on a server and I am using Nginx as proxy server to handle the request and redirect to application's particular port.

I wrote a short script in node.js which fetches IP and location of the users visiting my website. I can see the searched queries and usage of my API from external users and are same as those I can see via Google Analytics.

But I am also getting a strange hit to my server (and API links) from the IP address "::ffff:127.0.0.1". Why is that? Is that because of Nginx? How can I resolve this? Is this even an actual user or what?

Someone suggested that it might because of the Monitoring tool installed on your server. Can this be the reason as well or its something else?

2 comments
  • Mohsen47 April 28, 2017

    Hi @ok91

    This is the IP address of your proxy server "localhost" you need to tell Nginx to send this header X-Forwarded-For to enable your backend server to discover the real client's IP address.

    Check here for more info.

    Hope this helps you.

    Understanding Nginx HTTP Proxying, Load Balancing, Buffering, and Caching
    by Justin Ellingwood
    Nginx is a high performance reverse proxy server and web server. In this guide, we will explore Nginx's http proxying and load balancing capabilities. We will cover how Nginx can use buffers and caching to improve the proxying experience for clients.
  • ok91 April 28, 2017

    I have done that already and that works fine. On the node.js side, I believe i am capturing the user's IP with this code var getClientAddress = (req.headers['x-forwarded-for'] || '').split(',')[0] || req.connection.remoteAddress; with "satelize" package via NPM. It response with the desired output for external users but there are some internal hits from my own localhost 127.0.0.1. I need to know why is it so.

Log In to Comment
1 Answer
jtittle1 April 28, 2017

@ok91

::ffff:127.0.0.1 is the IPv6 version of an IPv4 IP address, just to clarify.

What does your current NGINX server block look like? (the one that has the proxy configuration)

Reply
  • ok91 April 28, 2017

    My NGINX works fine with the configuration and i am getting the actual IP from the external users. But in between the logs from external users there are some entries with my own localhost ip 127.0.0.1 and i would like to know why is that?

    Does VPS from Digital Ocean have some internal monitoring software pre-installed?

    • jtittle1 April 28, 2017

      @ok91

      If you enabled monitoring when deploying the Droplet, yes.

      Select additional options => Monitoring
      • ok91 April 28, 2017

        I dont remember something like this but my Droplet Configuration does show the Graph. How can i confirm this Monitoring setting now? Can i switch it on/off?

  • ok91 April 28, 2017

    Here's the NGINX Configuration. 

    server {
    listen 80;
    listen [::]:80;
    server_name abcxyz.com;

    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass "http://localhost:1234/";
    }
}
    • jtittle1 April 28, 2017

      @ok91

      You can check to see if do-agent is running by running:

      ps -aux | grep "do-agent"

      If the agent is enabled and running, you'll see something like this:

      root@ubuntu-2gb-nyc2-01:/usr/local/src# ps -aux | grep "do-agent"
root       831  0.0  0.0  12944   924 pts/0    S+   22:07   0:00 grep --color=auto do-agent
nobody    1644  0.0  0.6 350968 12608 ?        Ssl  19:51   0:03 /opt/digitalocean/bin/do-agent -log_syslog

      Otherwise you'll just see:

      root@ubuntu-2gb-nyc2-01:/usr/local/src# ps -aux | grep "do-agent"
root       831  0.0  0.0  12944   924 pts/0    S+   22:07   0:00 grep --color=auto do-agent

      Which means that it's not installed and running.

      ...

      As for the proxy configuration, personally, I like to expand on what is passed on, so I'd use something such as:

          proxy_temp_path /etc/nginx/cache/proxy;
    proxy_buffers 16 32k;
    proxy_buffer_size 64k;
    proxy_busy_buffers_size 128k;
    proxy_cache_bypass $http_pragma $http_authorization;
    proxy_connect_timeout 59s;
    proxy_hide_header X-Powered-By;
    proxy_http_version 1.1;
    proxy_ignore_headers Cache-Control Expires;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_404;
    proxy_no_cache $http_pragma $http_authorization;
    proxy_pass_header Set-Cookie;
    proxy_read_timeout 600;
    proxy_redirect off;
    proxy_send_timeout 600;
    proxy_temp_file_write_size 64k;
    proxy_set_header Accept-Encoding '';
    proxy_set_header Cookie $http_cookie;
    proxy_set_header Host $host;
    proxy_set_header Proxy '';
    proxy_set_header Referer $http_referer;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Original-Request $request_uri;

      If you use the above, you'll need to make sure that:

      proxy_temp_path

      ... points to a valid path. Unless you setup proxy caching, nothing will be added there, but this is more of a general production configuration, so I have it in most of my builds.

Have another answer? Share your knowledge.

Related Questions