Docs

Load Balancer

Obtaining the client source IP address

Layer 4 listener obtains client source IP

This topic explains how a layer 4 listener obtains the client's source IP address accessing the load balancing service through the Proxy Protocol.

Background

When the Classic Load Balancer (CLB) forwards access requests to the backend server, in the following scenarios the source address of the access request (i.e., the client address) will not be replaced. You can log in to the backend server and execute cat /var/log/nginx/access.log command to view the access logs and obtain the client's Source IP address.

Access request
Backend server
Server Group Type
Is the source IP address replaced
Is Proxy Protocol required
IPv4
IPv4
Server type
No
No
IPv6
IPv6
Server type
No
No

During the process of the CLB forwarding access requests to the backend server, in the following scenarios the source address of the access request (i.e., the client address) will be replaced. If the backend server needs to obtain the client's real IP address, it must use the Proxy Protocol.

Access request	Backend server	Server Group Type	Is the source IP address replaced	Is Proxy Protocol required
IPv4	IPv6	server type	Yes	Yes
IPv6	IPv4	Server type	Yes	Yes
IPv4	IPv4	IP type	Yes	Yes
IPv6	IPv4	IP type	Yes	Yes

tip

Only Layer-4 (TCP, UDP) listeners support the Proxy Protocol.

If the Layer-4 listener is connected to the Web Application Firewall (WAF), the WAF converts the client's IP address when the client request passes through it, causing the backend server to be unable to directly obtain the client's source IP address.

In this case, you can see Connecting to cloud WAF instances through CLB Layer-4 listeners to configure the HTTP Header field, allowing the WAF to carry the client's source IP to the backend server.

How it works

The process of CLB using Proxy Protocol with the backend server is as follows:

The client forwards access requests to the CLB.

CLB establishes a connection with the backend server.

CLB sends a Proxy Protocol packet containing the client's IP address and port number to the backend server.

The backend server receives and parses the Proxy Protocol packet to obtain the client's IP address and port number.

CLB sends the client's access request to the backend server.

The backend server handles the client's request.

Preparations

Please ensure you have completed the basic configuration of CLB. For detailed operations, please see CLB Getting Started.

Before enabling the Proxy Protocol feature, ensure that the service deployed on the backend server supports Proxy Protocol v2.

nginx version 1.13.11 and above support Proxy Protocol v2. This article uses Nginx 1.20.1 as an example.

Procedures

Step one: Enable Proxy Protocol

Click the name of the target CLB instance to enter the instance details page.

Select the Listener tab, click Edit Listener on the right of the target listener, and enable the Proxy Protocol switch.

Click Next step three consecutive times, and then click OK to complete the actions.

Step two: enable Proxy Protocol on backend services

Log in to the backend server. For detailed instructions, see Logging in to a Linux instance or Logging in to a Windows instance.

Run the following command to open the Nginx configuration file, nginx.conf.

vi /etc/nginx/nginx.conf

Press i to enter editing mode, and configure Proxy Protocol v2 to obtain the client's source address as follows.

http {
# $proxy_protocol_addr is used to record the client's real IP
# $remote_addr is used to record the Local IP of the CLB instance
log_format main '$proxy_protocol_addr - $remote_addr- $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
# Taking port 80 as an example, add the proxy_protocol field
server {
listen 80 proxy_protocol;
#...
}
}

Press Esc key to exit the edit mode, then type :wq to save and exit.

Run the following command to apply the configuration.

sudo nginx -s reload

Step 3: Verification

Open the browser on your local computer.

Input http://your custom domain name and display the application page deployed by the backend server, indicating that the Proxy Protocol configuration is complete.

Step 4: Obtain client Source IP address

Execute cat /var/log/nginx/access.log command, view the access Log, and obtain the client's Source IP address.

The format of the proxy protocol v2 packet header carrying the Source IP address of an IPv4 client is as follows:

/*
* Proxy Protocol Header:
* NAT44 Header
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | |
* | Signature |
* | |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Ver | Cmd | Af | Proto | Length |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | IPv4 Source Address |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | IPv4 Destination Address |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Source Port | Destination Port |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/

The format of the proxy protocol v2 packet header carrying the Source IP address of an IPv6 client is as follows:

/*
* Proxy Protocol Header:
* NAT66 Header
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | |
* | Signature |
* | |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Ver | Cmd | Af | Proto | Length |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | |
* | |
* | IPv6 Source Address |
* | |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | |
* | |
* | IPv6 Destination Address |
* | |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Source Port | Destination Port |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/

Last updated: 2026.08.06 14:31:17