Using reverse proxy prevent login flooding

Question

I have set $conf['reverse_proxy'] = TRUE; in settings.php, but the IP address logged in the flood table is 127.0.0.1, not the one passed through the X-Forwarded-For header. Nginx is configured to send the X-Forwarded-For header to Apache, but it seems Drupal isn't recognizing it.

This is pretty bad because a few failed logins can lockout for everyone.

How can I make Drupal use the IP passed within the X-Forwarded-For header?

Answer 1

I had to edit the $conf['reverse_proxy_addresses'] = array('a.b.c.d', ...); part, and put in the address of reverse proxy address (127.0.0.1).

Answer 2

In settings.php, set options and put your proxy IP.

// Reverse proxy support to make sure the real IP gets logged by Drupal.
$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = array('127.0.0.1');
$conf['reverse_proxy_header'] = 'HTTP_X_FORWARDED_FOR';