1. The problem I’m having:
I want my wordpress instance to see the real client IP instead of local IP of my varnish server : 127.0.0.1
Here is the operating diagram of my installation :
Client → 80/443 port → Caddy reverse proxy → 6081 → Varnish server → port number depends of backend → caddy webserver
2. Error messages and/or full log output:
Instead of only seeing the client IP, I have a suit of IP containing local IP :
IP FORWARD XXX.XXX.XXX, 127.0.0.1, 127.0.0.1, 127.0.0.1
XXX.XXX.XXX : is the real client IP
3. Caddy version:
v2.7.6 h1:w0NymbG2m9PcvKWsrXO6EEkY9Ru4FJK8uQbYcev1p3A=
4. How I installed and ran Caddy:
a. System environment:
Rocky Linux 9
b. Command:
sudo systemctl enable caddy
sudo systemctl start caddy
d. My complete Caddy config:
My principal caddyfile :
{
servers {
trusted_proxies static private_ranges
client_ip_headers X-Forwarded-For X-Real-IP
}
}
import Caddyfile.d/*.caddyfile
My caddyfile for domaine.fr
# Domaine test.domaine.fr
test.domaine.fr {
# Port où Varnish écoute les requêtes
reverse_proxy 127.0.0.1:6081
}
:8060 {
root * /srv/www/test
file_server
php_fastcgi unix//run/php-fpm/www.sock
encode zstd gzip
}
5. Links to relevant resources:
Here is varnishlog where we can see that Varnish recieve HTTP Header from caddy reverse proxy with only the client IP and then Varnish add multiple times the 127.0.01 IP adress.
How to tell to caddy web server to only select the most right non-local IP ?
[rocky@vps ~]$ varnishlog
* << Request >> 885930
- Begin req 885929 rxreq
- Timestamp Start: 1715532826.302347 0.000000 0.000000
- Timestamp Req: 1715532826.302347 0.000000 0.000000
- VCL_use boot
- ReqStart 127.0.0.1 38290 a0
- ReqMethod GET
- ReqURL /realip.php
- ReqProtocol HTTP/1.1
- ReqHeader Host: test.domaine.fr
- ReqHeader User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
- ReqHeader Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- ReqHeader Accept-Encoding: gzip, deflate, br, zstd
- ReqHeader Accept-Language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7
- ReqHeader Cache-Control: max-age=0
- ReqHeader Cookie: _ga=GA1.1.294261596.1572729531; opcachegui=true; _ga_T9DB9ZC6V0=GS1.1.1715473440.105.1.1715473462.0.0.0
- ReqHeader Dnt: 1
- ReqHeader Sec-Ch-Ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
- ReqHeader Sec-Ch-Ua-Mobile: ?0
- ReqHeader Sec-Ch-Ua-Platform: "Windows"
- ReqHeader Sec-Fetch-Dest: document
- ReqHeader Sec-Fetch-Mode: navigate
- ReqHeader Sec-Fetch-Site: none
- ReqHeader Sec-Fetch-User: ?1
- ReqHeader Upgrade-Insecure-Requests: 1
- ReqHeader X-Forwarded-For: XXX.XXX.XXX.XXX
- ReqHeader X-Forwarded-Host: test.domaine.fr
- ReqHeader X-Forwarded-Proto: https
- ReqUnset X-Forwarded-For: XXX.XXX.XXX.XXX
- ReqHeader X-Forwarded-For: XXX.XXX.XXX.XXX, 127.0.0.1
- VCL_call RECV
- ReqUnset X-Forwarded-For: XXX.XXX.XXX.XXX, 127.0.0.1
- ReqHeader x-forwarded-for: XXX.XXX.XXX.XXX, 127.0.0.1, 127.0.0.1
- ReqUnset Host: test.domaine.fr
- ReqHeader host: test.domaine.fr
- ReqURL /realip.php
- ReqUnset Cookie: _ga=GA1.1.294261596.1572729531; opcachegui=true; _ga_T9DB9ZC6V0=GS1.1.1715473440.105.1.1715473462.0.0.0
- VCL_return hash
- ReqUnset Accept-Encoding: gzip, deflate, br, zstd
- ReqHeader Accept-Encoding: gzip
- VCL_call HASH
- VCL_return lookup
- Hit 623667 3578.574584 10.000000 0.000000
- VCL_call HIT
- VCL_return deliver
- RespProtocol HTTP/1.1
- RespStatus 200
- RespReason OK
- RespHeader Content-Encoding: gzip
- RespHeader Content-Type: text/html; charset=UTF-8
- RespHeader Server: Caddy
- RespHeader Vary: Accept-Encoding
- RespHeader X-Powered-By: PHP/8.2.18
- RespHeader Date: Sun, 12 May 2024 16:53:24 GMT
- RespHeader Content-Length: 108
- RespHeader x-url: /realip.php
- RespHeader x-host: test.domaine.fr
- RespHeader X-Cacheable: YES:Forced
- RespHeader X-Varnish: 885930 623667
- RespHeader Age: 21
- RespHeader Via: 1.1 varnish (Varnish/6.6)
- VCL_call DELIVER
- RespUnset x-url: /realip.php
- RespUnset x-host: test.domaine.fr
- VCL_return deliver
- Timestamp Process: 1715532826.302429 0.000082 0.000082
- Filters
- RespHeader Accept-Ranges: bytes
- RespHeader Connection: keep-alive
- Timestamp Resp: 1715532826.302463 0.000116 0.000034
- ReqAcct 946 0 946 343 108 451
- End