Plesk with Nginx as Proxy detects 127.0.0.1 as remote IP

Issue

The internal IP address of the load balancer or proxy is displayed in domain logs (Domains > example.com > Logs) instead of the client's IP (real visitor's IP).

Environment

• Plesk
• Apache with Nginx
• Imunify360 can be blamed for the issue
• Cloudflare

Solution

Go to Domains > example.com > Apache & Nginx Settings and add the following content to the Additional Nginx directives, for Cloudflare use:

set_real_ip_from 127.0.0.0/8;
real_ip_header X-Forwarded-For;

On cPanel t should be enough to have

cat /etc/apache2/conf.d/i360.remoteip.conf
<IfModule remoteip_module>
    RemoteIPInternalProxy 127.0.0.1
    RemoteIPInternalProxy ::1
    RemoteIPHeader X-Forwarded-For
</IfModule>

WebShield does not require 127.0.0.1/8 subnets to be added to the remote-proxy list. Such subnets are already considered as a proxy.

Cause

Proxies and load balancers rewrite the origin IP address and specify the client's IP address in an additional HTTP header.

Useful links

• https://support.plesk.com/hc/en-us/articles/360025828373
• https://cloudlinux.zendesk.com/hc/en-us/articles/4411801942802-Wrong-IP-detection
• https://cloudlinux.zendesk.com/hc/en-us/articles/4411949215634-Imunify360-Server-s-interface-IP-matched-as-attackers-ip