using digitalocean loadbalancer, how to get real ip?

Digital ocean’s Loadbalancer does not send X-Forwarded-For header, so how to get real ip info with load balancer?


Regarding ingress-nginx, in my experience it suffices to

  1. set its use-proxy-protocol flag to “true” in the controller’s configmap, and
  2. enable the LB’s do-loadbalancer-enable-proxy-protocol; you can do this in the web UI.

See my blogpost for details

Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

DigitialOcean Load Balancers set the X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port headers to give backend nodes information about the original request. Though you’ll need to ensure that you web server or application is configured to log that.

For example, if you were using Nginx, you could capture the original IP for a request by configuring a custom log_format directive and using it in your access_log directive. On Ubuntu , you would need to edit the main Nginx config located at /etc/nginx/nginx.conf Here’s a very simple example as a proof of concept:

        log_format from-lb 'Original IP: $http_x_forwarded_for';
        access_log /var/log/nginx/access.log from-lb;

Of course, you’ll likely want to log more information than that. Here’s a more detailed log format that matches the default output but replaces uses the origin IP address:

        log_format main '$http_x_forwarded_for - $remote_user [$time_local] '
                        '"$request" $status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent"' ;

        access_log /var/log/nginx/access.log main;

If you’re using Nginx, you can find more details about configuring logging in this tutorial. If you aren’t, let us know what web server you’re using, and we can help more.

@GrantZvolsky — amazing answer, did the trick for me! The link to blog post is broken though, sadly :) Would love to read it!

The Load Balancer takes care of automatically renewing the Let’s Encrypt certificate for you. The only issue is when you host multiple vhosts behind the LB and you cant get a wildcard certificate or upload different certificates on the LB.

DO LB doesn’t pass user’s real ip when using https passthrough. In such case you must use SSL termination at Load balancer it self, however this is real deal if you’re using let’s encrypt free SSL with http01 validation. Because you have to re-new and re-upload licenses manually.

In case of https this only works when you do the SSL offloading on the load balancer. So if you need the client’s real IP address, don’t use certificate passthrough.