<p>In our environment, our traffic arrives at our applications via a proxy, and this traffic is received &amp; passed on by an nginx-ingress-controller.</p>
<p>At this nginx-ingress-controller, I'd like to do the following 3 things:</p>
<ul>
<li>Retrieve the &quot;real&quot; client's IP Address, so that we can use it for logging and so on, in our upstream applications.</li>
<li>Enforce rate-limiting based on the client's &quot;real&quot; IP Address, to ensure that we don't have bad actors trying to muck about with our applications</li>
<li>Only allow connections to our nginx-ingress-controller from the proxy server</li>
</ul>
<p>From all of my experiments, it seems like it's an either or scenario. I.e. Either I can retrieve the clients &quot;real&quot; IP address and use it for rate-limiting/pass it upstream for logging OR I can work with the Proxy server's connecting IP Address and enforce my whitelist.</p>
<p>It feels like it should be possible to do all three, but I just haven't managed to get it right yet.</p>
<p>We're running the controller on kubernetes, and I'm injecting all of the relevant config using a config map. Here are the settings that I'm injecting:</p>
<pre><code>  'proxy-real-ip-cidr': '173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32'
  'use-forwarded-headers': 'true'
  'forwarded-for-header': 'CF-Connecting-IP'
  'server-tokens': 'false'
  'proxy-body-size': '100M'
  'http-snippet' : |
          limit_req_zone $binary_remote_addr zone=perip:10m rate=20r/s;
  'location-snippet' : |
          limit_req zone=perip burst=40 nodelay;
          limit_req_status 429;
          limit_conn_status 429;
          allow 173.245.48.0/20;
          allow 103.21.244.0/22;
          allow 103.22.200.0/22;
          allow 103.31.4.0/22;
          allow 141.101.64.0/18;
          allow 108.162.192.0/18;
          allow 190.93.240.0/20;
          allow 188.114.96.0/20;
          allow 197.234.240.0/22;
          allow 198.41.128.0/17;
          allow 162.158.0.0/15;
          allow 104.16.0.0/12;
          allow 172.64.0.0/13;
          allow 131.0.72.0/22;
          allow 2400:cb00::/32;
          allow 2606:4700::/32;
          allow 2803:f800::/32;
          allow 2405:b500::/32;
          allow 2405:8100::/32;
          allow 2a06:98c0::/29;
          allow 2c0f:f248::/32;
          deny all;
</code></pre>
<p>Please let me know if you have any questions, or if I can explain any of the above a bit more clearly. Any and all help is greatly appreciated!</p>
<p>EDIT:
I've found a feature request on Kubernetes/inress-nginx that deals with the exact mechanism that I'm looking for, but it doesn't seem to have ever been addressed: <a href="https://github.com/kubernetes/ingress-nginx/issues/2257" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/issues/2257</a>
So if anybody knows of any workarounds, that would be greatly appreciated.</p>

Duncan Gener8
<p>So ultimately, I wasn't able to achieve the goal specifically laid out in my original post, but I was able to create a workaround.</p>
<p>Since our infrastructure is hosted in GCP on GKE, I was able to replace our existing Layer 4 load balancer with a Layer 7 Load Balancer, which allowed me to enforce the IP Address whitelisting by using a Cloud Armor policy, and leave the rate-limiting on the &quot;real&quot; client IPs up to nginx.</p>
