Comment on [PSA] Watch for the antiyanks troll and consider adjusting your rate limits

• Sal@mander.xyz ⁨2⁩ ⁨days⁩ ago

  Thanks! Yes, I saw both messages and I am now going through the NGINX config and trying to understand what could be going on. To be honest, Lemmy is the hobby that taught me what a ‘reverse proxy’ and a ‘vps’ are. Answering a question such as ‘Are you sending the client IP in the X-Forwarded-For header?’ is probably straight forward for a professional but for me it involves quite a bit of learning 😅

  At location /, my nginx config includes:

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  

  So, I think that the answer to your question is probably ‘yes’. If you did have these rate limits and they were stable, the more likely explanation is that something about my configuration is sub-optimal. I will look into it and continue learning, but I will need to keep my limits a bit high for the time being and stay alert.

  source

  • admiralpatrick@lemmy.world ⁨2⁩ ⁨days⁩ ago

    Yeah, you are setting it, but that’s assuming the variable $proxy_add_x_forwarded_for has the correct IP. But the config itself is correct.

    Do you have a separate location block for /api by chance, and is the proxy_set_header directive set there, too? Unless I’m mistaken, location blocks don’t inherit that from the / location.

    source

    • Sal@mander.xyz ⁨2⁩ ⁨days⁩ ago

      Yes, I see this there. Most of the nginx config is from the ‘default’ nginx config in the Lemmy repo from a few years ago. My understanding is somewhat superficial - I don’t actually know where the variable ‘$proxy_add_x_forwarded_for’ gets populated, for example. I did not know that this contained the client’s IP.

          # backend
          location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
            proxy_pass http://0.0.0.0:8536/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
      
            # Rate limit
            limit_req zone=mander_ratelimit burst=30000 nodelay;
      
            # Add IP forwarding headers
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          }
      
      

      I need to do some reading 😁

      source

      • admiralpatrick@lemmy.world ⁨2⁩ ⁨days⁩ ago

        nginx.org/en/docs/…/ngx_http_proxy_module.html

        $proxy_add_x_forwarded_for is a built-in variable that either adds to the existing X-Forwarded-For header, if present, or adds the XFF header with the value of the built-in $remote_ip variable.

        The former case would be when Nginx is behind another reverse proxy, and the latter case when Nginx is exposed directly to the client.

        Assuming this Nginx is exposed directly to the clients, maybe try changing the bottom section like this to use the $remote_addr value for the XFF header. The commented one is just to make rolling back easier. Nginx will need to be reloaded after making the change, naturally.

             # Add IP forwarding headers
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header Host $host;
              # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-For $remote_addr;
        

        source

        • -> View More Comments