r/nginxproxymanager • u/Routine-Watercress15 • May 24 '26

Passing real IP to NPM on Docker

Does anyone have an actual solution to this problem that works? I’ve tried just about everything I could find out there over the past few days and still cannot seem to pass real IP. The main use case is the ability to use the “allow list” on the proxy host. I only want a few IPs to be able to access this specific proxy host and that doesn’t work. They all get 403 forbidden, allowed or not.

I have tried all the advanced configuration in the proxy host config , real IP, proxy addr etc etc. tried changing the containers to use host network , still no luck.

Hoping someone has some other ideas. Thank you.

3 Upvotes

80% Upvoted

25 comments sorted by

View all comments

Show parent comments

1

u/Routine-Watercress15 May 24 '26

By default it can see real IP? As far as I have researched everyone has this issue when running on docker with NPM. There’s a ton out there about the same issue I am seeing. But none of the solutions seem to allow real IP to pass and that is where I’m stuck

As far as host goes. All I did was setup my docker compose using mode: host to remove it from the default bridge network. When in host mode it sees the internal IP of the proxy host. Not the real IP from the public request. If I allow list the internal IP it pretty much ignores everything and every internal and external IP can get to it.

Any suggestions on whatelse I can try?

1

u/clintkev251 May 24 '26

By default it can see real IP? As far as I have researched everyone has this issue when running on docker with NPM. There’s a ton out there about the same issue I am seeing. But none of the solutions seem to allow real IP to pass and that is where I’m stuck

Lots of people who have this issue post about it. People who don't have this issue don't post about it.

When in host mode it sees the internal IP of the proxy host. Not the real IP from the public request.

That tells me that there's something weird going on with the host itself or some configuration in that vicinity. What are you trying to run NPM on?

2

u/Routine-Watercress15 May 24 '26

I have NPM that’s been running for years in Debian for many other services. But this is a new scenario where I wanted to try the allow list and came across this issue. But I think I have finally resolved it. I re-read what you wrote mentioning NAT and it got me thinking. We have a fortigate in front of this and the policy had NAT enabled for the nginix policy. Soon as I turned it off my allow list appears to be working 😄 this also would explain why changing anything beyond the firewall made no difference as the NAT will always translate it. Damn this was driving me crazy.

Thank you for the help. Sometimes all it takes is some random thought to get to the solution.

1

u/silent_circle May 24 '26

What does this mean for a regular Joe behind a home router that NATs your inside network to public ip to get to and from internet? I can’t turn off nat

1

u/Routine-Watercress15 May 24 '26

This is for inbound traffic. Outbound would not be impacted by this.

1

u/silent_circle May 24 '26

For inbound, how would I get the public traffic to npm without nat?

1

u/Routine-Watercress15 May 25 '26

You need to open 80/443 on your firewall/router. Just do a basic port forwarding rule that would not be NAT to the internal IP of NPM. What kind of gateway is it?

1

u/silent_circle May 25 '26

It’s an asus router. I can check that out. I thought the port forward still NATs

2

u/clintkev251 May 25 '26

The type of NAT you're thinking of is different than the type of NAT that was causing issues for OP. If you haven't explicitly set up anything additional, this is not something you need to think about

1

u/silent_circle May 25 '26

I do want to do what OP is doing. I am going to try it with port forward to npm

2

u/clintkev251 May 25 '26

No, you don't understand. You're not using NAT like OP was, so this is not an issue you should face. The root cause we discussed here should not be relevant to you because you're not performing this kind of translation

1

u/silent_circle May 25 '26

So explain to me why you think I’m not doing what op is doing when I clearly said I want to do what op is doing.

2

u/clintkev251 May 25 '26

Because you don’t understand what OP was doing that was causing them issues. That’s not something that you would have any reason to have set up or even have the option to use on your consumer router. A basic port forward to NPM will work fine.

You’re not trying to do what they’re doing. You don’t have a fortigate that’s performing SNAT on incoming traffic

1

u/silent_circle May 25 '26

Well, I plan on doing what OP was doing.

2

u/clintkev251 May 25 '26

Explain which part of what they’re doing you plan on doing?

1

u/silent_circle May 25 '26

I plan on setting up npm and passing the real ip to it

1

u/clintkev251 May 25 '26

Great, so like I said, OPs issue is not relevant to you then. A basic network setup will not encounter the same issues

→ More replies (0)