In some applications, it's helpful (or required) to know the IP address where the request originally came from, referred to as the client IP. When a NodeBalancer routes traffic to a backend node, the originating IP address becomes the NodeBalancer's private IP address. This means that the client IP's address is not visible in the location that the application might typically check. To overcome this, there are a few ways to pass the client's IP address to the backend nodes. The method you select depends on the protocol the NodeBalancer's port is using.

• Proxy Protocol: This method works for the TCP protocol, provided the backend application also supports it. See Proxy Protocol.
• HTTP Headers: This method works for the HTTP and HTTPS protocols and is discussed below.

HTTP headers (using HTTP or HTTPS protocols)

NodeBalancers add an X-Forwarded-For (XFF) HTTP header field, which allows your nodes to identify a client's originating IP address. This is useful for logging purposes. Here's an example XFF HTTP header:

X-Forwarded-For: 196.180.44.172

To capture and log the original client IP address, configure your web server software to trust requests from the NodeBalancer and extract the X-Forwarded-For header.

NodeBalancer IP addresses

The IP range you specify in your web server's proxy configuration depends on your NodeBalancer's Backend Connectivity setting:

• Legacy private IPv4. Uses the 192.168.255.0/24 subnet.
• VPC. Uses the subnet IP range allocated within your VPC.
• Public IPv6. Uses the NodeBalancer's public IPv6 address/prefix. Run the Get a NodeBalancer's backend IPv6 prefix operation to retrieve this prefix (e.g., 2600:3c22:1:20:0:3039::/96).

Apache

If you're using the Apache web server, you can use the mod_rpaf to replace REMOTE_ADDR with the client's IP address in the XFF header. After you install the module, you'll need to specify the private IPv4, or the VPC subnet IP, or the public IPv6 address range as a proxy in httpd.conf. Click on the tabs for examples.

RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 192.168.255.0/24

RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.0.0.0/24

RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 2600:3c22:1:20:0:3039::/96

Nginx

If you're using the Nginx web server, you can add the following lines to your Nginx configuration file. Click on the tabs for examples.

real_ip_header X-Forwarded-For;
set_real_ip_from 192.168.255.0/24;

real_ip_header X-Forwarded-For;
set_real_ip_from 10.0.0.0/24;

real_ip_header X-Forwarded-For;
set_real_ip_from 2600:3c22:1:20:0:3039::/96;

This will allow Nginx to capture the client's IP address in the logs.