The real IP address cannot be obtained in the container

[107295472]

map $http_x_forwarded_for $first_ip {
           ~^([^,]+) $1;
            default $remote_addr; 
        }

 location ^~ /api/ {
            proxy_set_header X-Real-IP $first_ip;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_pass http://127.0.0.1:9180;
		}




curl http://127.0.0.1:9180/apisix/admin/routes/GetRegisterCodeNew \
  -X PUT \
  -H "X-API-KEY: $admin_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "code",
    "uri": "/api/Auth/GetRegisterCodeNew",
    "plugins": {
      "limit-count": {
        "count": 8,
        "time_window": 60,
        "rejected_code": 429,
        "key_type": "var",
        "key": "$http_x_real_ip"
      },
      "response-rewrite": {
      "headers": {
        "X-Debug-Real-IP": "$http_x_real_ip",
        "X-Debug-Forwarded-For": "$http_x_forwarded_for",
        "X-Debug-Remote-Addr": "$remote_addr"
      }
    }
    },
    "upstream": {
      "type": "roundrobin",
      "nodes": {
        "172.16.0.138:1999": 1
      }
    }
  }'

curl http://127.0.0.1:9180/apisix/admin/plugin_metadata/error-log-logger \
  -X PUT \
  -H "X-API-KEY: $admin_key" \
  -d '{
  "tcp": {
    "host": "172.17.0.1",
    "port": 10088
  },
  "inactive_timeout": 1,
  "log_format": {
    "client": "$http_x_real_ip",
    "host": "$host",
    "request": "$request",
    "response_status": "$status",
    "time": "$time_iso8601",
    "error_message": "$err_msg"
  }
}'


I want to get the real IP address in the error log. But the client is still the container's ip

[dosubot[bot]]

In containerized environments, APISIX will see the container or proxy IP unless you configure it to trust and extract the real client IP from headers. To fix this, you should:

1. Update APISIX's NGINX configuration (httpSrv block) to trust proxy headers:

   set_real_ip_from 0.0.0.0/0;
   real_ip_header X-Forwarded-For;
   real_ip_recursive on;
   

   This lets APISIX use the real client IP from the X-Forwarded-For header instead of the container IP [source].

2. Use the real-ip plugin in your route, setting source to http_x_forwarded_for (or http_x_real_ip if that's what your proxy sets), and configure trusted_addresses and recursive as needed. Example:

   "plugins": {
     "real-ip": {
       "source": "http_x_forwarded_for",
       "recursive": true,
       "trusted_addresses": ["your_proxy_ip_or_cidr"]
     }
   }

   This ensures APISIX extracts the real client IP from the header, even behind multiple proxies [source].

3. After this, $remote_addr and $http_x_real_ip should reflect the real client IP in your logs and plugins. You can use the response-rewrite plugin to debug what APISIX sees after these changes [source].

If you still see the container IP, double-check your proxy chain and make sure the real client IP is being forwarded in the headers. If you have a more complex proxy setup, you may need to adjust trusted_addresses accordingly.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[107295472]

Robot, I've used all of what you said.

[Baoyuantop]

Can you share the configuration you tried last? I don't see the real-ip plugin in the current configuration.

[107295472]

"real-ip": {
"source": "$http_x_real_ip",
"trusted_addresses": ["0.0.0.0/24"]
}

[107295472]

Does error log have log_format?，http log can get the real IP address of the variable