Server receiving hit from this IP Address "::ffff:127.0.0.1". Why is that and how to resolve this?

Question

I have a MEAN Stack application deployed on a server and I am using Nginx as proxy server to handle the request and redirect to application’s particular port.

I wrote a short script in node.js which fetches IP and location of the users visiting my website. I can see the searched queries and usage of my API from external users and are same as those I can see via Google Analytics.

But I am also getting a strange hit to my server (and API links) from the IP address “::ffff:127.0.0.1”. Why is that? Is that because of Nginx? How can I resolve this? Is this even an actual user or what?

Someone suggested that it might because of the Monitoring tool installed on your server. Can this be the reason as well or its something else?

Answer 1

jtittle1 April 28, 2017

@ok91

::ffff:127.0.0.1 is the IPv6 version of an IPv4 IP address, just to clarify.

What does your current NGINX server block look like? (the one that has the proxy configuration)

Reply Report

ok91 April 28, 2017

My NGINX works fine with the configuration and i am getting the actual IP from the external users. But in between the logs from external users there are some entries with my own localhost ip 127.0.0.1 and i would like to know why is that?

Does VPS from Digital Ocean have some internal monitoring software pre-installed?
Reply Report
- jtittle1 April 28, 2017
  
  @ok91
  
  If you enabled monitoring when deploying the Droplet, yes.
  
  Select additional options => Monitoring
  
  Reply Report
  
  ok91 April 28, 2017
  
  I dont remember something like this but my Droplet Configuration does show the Graph. How can i confirm this Monitoring setting now? Can i switch it on/off?
  
  Reply Report

ok91 April 28, 2017

Here’s the NGINX Configuration.

server {
    listen 80;
    listen [::]:80;
    server_name abcxyz.com;

    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass "http://localhost:1234/";
    }
}

Reply Report

jtittle1 April 28, 2017

@ok91

You can check to see if do-agent is running by running:

ps -aux | grep "do-agent"

If the agent is enabled and running, you’ll see something like this:

root@ubuntu-2gb-nyc2-01:/usr/local/src# ps -aux | grep "do-agent"
root       831  0.0  0.0  12944   924 pts/0    S+   22:07   0:00 grep --color=auto do-agent
nobody    1644  0.0  0.6 350968 12608 ?        Ssl  19:51   0:03 /opt/digitalocean/bin/do-agent -log_syslog

Otherwise you’ll just see:

root@ubuntu-2gb-nyc2-01:/usr/local/src# ps -aux | grep "do-agent"
root       831  0.0  0.0  12944   924 pts/0    S+   22:07   0:00 grep --color=auto do-agent

Which means that it’s not installed and running.

…

As for the proxy configuration, personally, I like to expand on what is passed on, so I’d use something such as:

    proxy_temp_path /etc/nginx/cache/proxy;
    proxy_buffers 16 32k;
    proxy_buffer_size 64k;
    proxy_busy_buffers_size 128k;
    proxy_cache_bypass $http_pragma $http_authorization;
    proxy_connect_timeout 59s;
    proxy_hide_header X-Powered-By;
    proxy_http_version 1.1;
    proxy_ignore_headers Cache-Control Expires;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_404;
    proxy_no_cache $http_pragma $http_authorization;
    proxy_pass_header Set-Cookie;
    proxy_read_timeout 600;
    proxy_redirect off;
    proxy_send_timeout 600;
    proxy_temp_file_write_size 64k;
    proxy_set_header Accept-Encoding '';
    proxy_set_header Cookie $http_cookie;
    proxy_set_header Host $host;
    proxy_set_header Proxy '';
    proxy_set_header Referer $http_referer;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Original-Request $request_uri;

If you use the above, you’ll need to make sure that:

proxy_temp_path

… points to a valid path. Unless you setup proxy caching, nothing will be added there, but this is more of a general production configuration, so I have it in most of my builds.

Reply Report

Answer 2

ok91 April 28, 2017

My NGINX works fine with the configuration and i am getting the actual IP from the external users. But in between the logs from external users there are some entries with my own localhost ip 127.0.0.1 and i would like to know why is that?

Does VPS from Digital Ocean have some internal monitoring software pre-installed?
Reply Report
- jtittle1 April 28, 2017
  
  @ok91
  
  If you enabled monitoring when deploying the Droplet, yes.
  
  Select additional options => Monitoring
  
  Reply Report
  
  ok91 April 28, 2017
  
  I dont remember something like this but my Droplet Configuration does show the Graph. How can i confirm this Monitoring setting now? Can i switch it on/off?
  
  Reply Report

ok91 April 28, 2017

Here’s the NGINX Configuration.

server {
    listen 80;
    listen [::]:80;
    server_name abcxyz.com;

    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass "http://localhost:1234/";
    }
}

Reply Report

jtittle1 April 28, 2017

@ok91

You can check to see if do-agent is running by running:

ps -aux | grep "do-agent"

If the agent is enabled and running, you’ll see something like this:

root@ubuntu-2gb-nyc2-01:/usr/local/src# ps -aux | grep "do-agent"
root       831  0.0  0.0  12944   924 pts/0    S+   22:07   0:00 grep --color=auto do-agent
nobody    1644  0.0  0.6 350968 12608 ?        Ssl  19:51   0:03 /opt/digitalocean/bin/do-agent -log_syslog

Otherwise you’ll just see:

root@ubuntu-2gb-nyc2-01:/usr/local/src# ps -aux | grep "do-agent"
root       831  0.0  0.0  12944   924 pts/0    S+   22:07   0:00 grep --color=auto do-agent

Which means that it’s not installed and running.

…

As for the proxy configuration, personally, I like to expand on what is passed on, so I’d use something such as:

    proxy_temp_path /etc/nginx/cache/proxy;
    proxy_buffers 16 32k;
    proxy_buffer_size 64k;
    proxy_busy_buffers_size 128k;
    proxy_cache_bypass $http_pragma $http_authorization;
    proxy_connect_timeout 59s;
    proxy_hide_header X-Powered-By;
    proxy_http_version 1.1;
    proxy_ignore_headers Cache-Control Expires;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_404;
    proxy_no_cache $http_pragma $http_authorization;
    proxy_pass_header Set-Cookie;
    proxy_read_timeout 600;
    proxy_redirect off;
    proxy_send_timeout 600;
    proxy_temp_file_write_size 64k;
    proxy_set_header Accept-Encoding '';
    proxy_set_header Cookie $http_cookie;
    proxy_set_header Host $host;
    proxy_set_header Proxy '';
    proxy_set_header Referer $http_referer;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Original-Request $request_uri;

If you use the above, you’ll need to make sure that:

proxy_temp_path

… points to a valid path. Unless you setup proxy caching, nothing will be added there, but this is more of a general production configuration, so I have it in most of my builds.

Reply Report

Related

Question

Server receiving hit from this IP Address "::ffff:127.0.0.1". Why is that and how to resolve this?

Related

Leave a comment

Looking for something else?

Sign up for our newsletter

Related

Question

Server receiving hit from this IP Address "::ffff:127.0.0.1". Why is that and how to resolve this?

Related

Leave a comment

Related

question

Serving two websites on one Nginx

question

Perfect way to install nginx with pagespeed on Ubuntu

question

I have a few question about moint configuration

question

my site i down please see http://www.cheri3a.com/

Looking for something else?