Arch Linux

limser

Member

Registered: 2015-05-04

Posts: 3

nginx client_ip in log file, with ssh -R Port forwarding

Hi, everyone!
First, I run a nginx server M1 (in my offce)  behind a router R1 and M1's IP addr is 192.168.5.126. I set nginx's log format like this:

   log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

After that, I will get the correct client ip in the access log.

192.168.5.88 - - [21/Apr/2015:11:12:47 +0800] "GET /js/date.js HTTP/1.1" 200 403 "http://192.168.5.126/" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36" "-" 

Then, I want to visit M1 outside (in the campus) .  Unfortunately, I can do nothing with the router R1. But I have a router R2 whose framework is OpenWrt and its IP 222.xx.xx.xx can be visited by anyone who has logged into the campus network.
Then I wrote a autossh service to do that:

[Unit]
Description=AutoSSH service for local port 80 forwarded to 222.xx.xx.xx:80
# place this in /etc/systemd/system/, than enable this.
After=network.target
Requires=nginx.service
After=nginx.service

[Service]
Environment="AUTOSSH_GATETIME=0" "AUTOSSH_POLL=60" "AUTOSSH_LOGFILE=/var/log/nginxssh.log"
ExecStart=/usr/bin/autossh -M 22000 -NR 222.xx.xx.xx:808:localhost:808 -NR 222.xx.xx.xx:80:localhost:80 -o TCPKeepAlive=yes -p xxxx root@222.xx.xx.xx -i /home/username/.ssh/id_rsa

[Install]
WantedBy=multi-user.target

Yeah, It works! BUT BUT when someone visits 222.xx.xx.xx, I lost the  the client ip in nginx log file. That would always be 127.0.0.1, why?

127.0.0.1 - - [27/Apr/2015:00:34:07 +0800] "GET /static/mathjax/MathJax.js?config=TeX-AMS_HTML HTTP/1.1" 304 0 "http://222.xx.xx.xx:808/url/jakevdp.github.com/downloads/notebooks/XKCD_plots.ipynb" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:37.0) Gecko/20100101 Firefox/37.0" "-"

After ``ssh -R Port forwarding``,  client ip is lost?
If so,  what should I use to replace ``ssh -R``?

Last edited by limser (2015-05-04 12:39:18)