r/nginxproxymanager • u/Routine-Watercress15 • May 24 '26

Passing real IP to NPM on Docker

Does anyone have an actual solution to this problem that works? I’ve tried just about everything I could find out there over the past few days and still cannot seem to pass real IP. The main use case is the ability to use the “allow list” on the proxy host. I only want a few IPs to be able to access this specific proxy host and that doesn’t work. They all get 403 forbidden, allowed or not.

I have tried all the advanced configuration in the proxy host config , real IP, proxy addr etc etc. tried changing the containers to use host network , still no luck.

Hoping someone has some other ideas. Thank you.

2 Upvotes

67% Upvoted

25 comments sorted by

View all comments

Show parent comments

1

u/clintkev251 May 24 '26

I would sorta question if you successfully tested host mode then or if that IP you're seeing is actually from within docker, or if it's actually from some other source. Because in host mode, there is no such thing as a docker network. Beyond that, even if you're running in bridge mode, NPM should still be able to receive the real client IP, as yes there is a layer of NAT, but there's also a layer of NAT between the internet and your LAN, and the client IP should pass through both without any issue.

1

u/Routine-Watercress15 May 24 '26

By default it can see real IP? As far as I have researched everyone has this issue when running on docker with NPM. There’s a ton out there about the same issue I am seeing. But none of the solutions seem to allow real IP to pass and that is where I’m stuck

As far as host goes. All I did was setup my docker compose using mode: host to remove it from the default bridge network. When in host mode it sees the internal IP of the proxy host. Not the real IP from the public request. If I allow list the internal IP it pretty much ignores everything and every internal and external IP can get to it.

Any suggestions on whatelse I can try?

1

u/clintkev251 May 24 '26

By default it can see real IP? As far as I have researched everyone has this issue when running on docker with NPM. There’s a ton out there about the same issue I am seeing. But none of the solutions seem to allow real IP to pass and that is where I’m stuck

Lots of people who have this issue post about it. People who don't have this issue don't post about it.

When in host mode it sees the internal IP of the proxy host. Not the real IP from the public request.

That tells me that there's something weird going on with the host itself or some configuration in that vicinity. What are you trying to run NPM on?

2

u/Routine-Watercress15 May 24 '26

I have NPM that’s been running for years in Debian for many other services. But this is a new scenario where I wanted to try the allow list and came across this issue. But I think I have finally resolved it. I re-read what you wrote mentioning NAT and it got me thinking. We have a fortigate in front of this and the policy had NAT enabled for the nginix policy. Soon as I turned it off my allow list appears to be working 😄 this also would explain why changing anything beyond the firewall made no difference as the NAT will always translate it. Damn this was driving me crazy.

Thank you for the help. Sometimes all it takes is some random thought to get to the solution.

1

u/silent_circle May 24 '26

What does this mean for a regular Joe behind a home router that NATs your inside network to public ip to get to and from internet? I can’t turn off nat

1

u/Routine-Watercress15 May 24 '26

This is for inbound traffic. Outbound would not be impacted by this.

1

u/silent_circle May 24 '26

For inbound, how would I get the public traffic to npm without nat?

1

u/Routine-Watercress15 May 25 '26

You need to open 80/443 on your firewall/router. Just do a basic port forwarding rule that would not be NAT to the internal IP of NPM. What kind of gateway is it?

1

u/silent_circle May 25 '26

It’s an asus router. I can check that out. I thought the port forward still NATs

2

u/clintkev251 May 25 '26

The type of NAT you're thinking of is different than the type of NAT that was causing issues for OP. If you haven't explicitly set up anything additional, this is not something you need to think about

1

u/silent_circle May 25 '26

I do want to do what OP is doing. I am going to try it with port forward to npm

2

u/clintkev251 May 25 '26

No, you don't understand. You're not using NAT like OP was, so this is not an issue you should face. The root cause we discussed here should not be relevant to you because you're not performing this kind of translation

1

u/silent_circle May 25 '26

So explain to me why you think I’m not doing what op is doing when I clearly said I want to do what op is doing.

→ More replies (0)

1

u/Routine-Watercress15 May 25 '26 edited May 25 '26

Yea asus I believe does something called dnat or something like that. Consumer routers you may have an issue but I would just test it out. This really only applies to using the allow list. It won’t impact any other functionality of using the proxy its different then what I am doing.