All connection with same IP...disable the reverse proxy?

maxlinux2000 · Post by **maxlinux2000** » Thu Apr 09, 2015 2:50 pm

Hi All

I have a server (at digitalocean.com) with debian7+vestacp.
In my domain I have a forum (phpbb 3.1)

when I look the logs some strange occours:

Code: Select all

Google [Bot] IP: 103.26.15.221 » Whois	
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 	Indice 	09/04/2015, 15:41
maxlinux2000 IP: 103.26.15.221 » Whois	
Mozilla/5.0 (X11; Linux i686; rv:37.0) Gecko/20100101 Firefox/37.0 Iceweasel/37.0 	Sta visualizzando chi c’è in linea 	09/04/2015, 15:41
Ospite IP: 103.26.15.221 » Whois	
Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2 	Indice 	09/04/2015, 15:41
celestograf IP: 103.26.15.221 » Whois	
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; NP08; MAAU; NP08; rv:11.0) like Gecko 	Indice 	09/04/2015, 15:40
silvernik IP: 103.26.15.221 » Whois	
Mozilla/5.0 (iPad; CPU OS 8_3 like Mac OS X) AppleWebKit/600.1.4.15.16 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3 	Sta leggendo un argomento in Oggi al polso indosso.... 	09/04/2015, 15:38
aquaman* IP: 103.26.15.221 » Whois	
Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36 	Sta leggendo un argomento in Compro - Vendo Orologi Vintage 	09/04/2015, 15:38

Please note the IP addresses... this IP is the same of my server and all peuple an bots, have same IP.

This occurs when there is a web accelerator in the middle, so I wrote to digitalocean support, and they tell me:

Hello Max,

I assure you that there is not a web accelerator in digitalocean.com, but it sounds like your server may be using an Nginx reverse-proxy.
If this is the case, I've found a guide online that should assist you with forwarding the correct IP address:

http://chrismorris.org/passing-ip-from-nginx-to-apache/

Any idea how to disable the reverse proxy or implement the solution of chrismorris?

regards
MaX

maxlinux2000 · Post by **maxlinux2000** » Thu Apr 09, 2015 3:06 pm

I have installed libapache2-mod-rpaf

# # apt-get install libapache2-mod-rpaf
Reading package lists... Done
Building dependency tree
Reading state information... Done
libapache2-mod-rpaf is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

then I have modified the file:
/etc/nginx/conf.d/103.26.15.221.conf

Code: Select all

server {
    listen       103.26.15.221:80 default;
    server_name  _;
    #access_log  /var/log/nginx/103.26.15.221.log main;
    location / {
        proxy_pass  http://103.26.15.221:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   }
}

and /etc/apache2/apache2.conf, adding:

Code: Select all

<IfModule mod_rpaf.c>
    RPAFenable On
    RPAFsethostname On
    RPAFproxy_ips 127.0.0.1
</IfModule>

then restart both services:
# service nginx restart
# service apache2 restart

...but my site still have theis problem

maxlinux2000 · Post by **maxlinux2000** » Thu Apr 09, 2015 3:15 pm

test 2:

I tryed too modify the files in /home/forum-user/conf/web, the files: apache2.conf and nginx.conf

then restarting the services.... but not!! again!

Post by **skurudo** » Sat Apr 11, 2015 10:25 pm

Don't rush with disabling nginx, better use mod_rpaf for apache2 ^_^

In console

Code: Select all

mv /etc/apache2/mods-enabled/rpaf.conf /etc/apache2/mods-available/rpaf.conf

Code: Select all

a2enmod rpaf

After this edit your file - /etc/apache2/mods-available/rpaf.conf and add your IP RPAFproxy_ips

Code: Select all

<IfModule rpaf_module>
    RPAFenable On

    # When enabled, take the incoming X-Host header and
    # update the virtualhost settings accordingly:
    RPAFsethostname On

    # Define which IP's are your frontend proxies that sends
    # the correct X-Forwarded-For headers:
    RPAFproxy_ips 127.0.0.1 and-there-YOUR-server-IP

    # Change the header name to parse from the default
    # X-Forwarded-For to something of your choice:
    #RPAFheader X-Real-IP X-Forwarded-For
</IfModule>

And finally restart apache2 and test this )

sionandes · Post by **sionandes** » Mon Apr 13, 2015 5:47 am

@maxlinux2000 & @skurudo I also have Server at DigitalOcean with debian7wheezy + Vestacp installed on it.

below are my logs which I copied from vestacp admin panel. I'm not sure same problem like yours happening with me too or not? can you please check and tell me if all is good or not.

because I'm also using nginx as a Reverse proxy.

Code: Select all

66.249.73.158 - - [13/Apr/2015:04:22:30 +0000] "GET /catalog/view/javascript/jquery/ui/jquery-ui-timepicker-addon.js HTTP/1.1" 200 8726 "http://mysite.com/Samsung.html/Samsung-Galaxy-Young-2.html" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
180.76.5.168 - - [13/Apr/2015:04:43:30 +0000] "GET /Huawei-Ascend-Y600.html HTTP/1.0" 200 12333 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
66.249.73.204 - - [13/Apr/2015:04:50:32 +0000] "GET /Nokia-Asha-300.html HTTP/1.0" 200 11634 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.73.204 - - [13/Apr/2015:04:54:04 +0000] "GET /image/data/Products/Nokia/Nokia-Asha-300.gif HTTP/1.1" 200 36162 "-" "Googlebot-Image/1.0"
42.201.160.164 - - [13/Apr/2015:05:14:53 +0000] "GET /vstats/ HTTP/1.0" 200 511 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36"

BTW I'm worried because I don't know why but after moving my other sites from shared hosting to VPS - (vestacp+debian7).. I noticed huge bounce rate.. which is really bad ;- ( I noticed organic searches coming and leaving my site with 0 sec waiting ?? and it's happening for last 10 days on all sites moved.. by the way I'm using Google analytics and I'm really worried..

thank you

Vesta Control Panel - Forum