How to set client IP when using tunnel

[Kaciras]

I have setup a tunnel following the example, but in the event page, I see the user IP is my tunnel server. Is there any way to set the real client IP?

[AbhiPrasad]

Hey! You can set the IP in the X-Forwarded-For header in the request you send to Sentry. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For

• https://forum.sentry.io/t/real-client-ip-with-sentry-nextjs-tunnel/15438
• Sentry ignores remote IP address with nginx proxy (X-Forwarded-For header) sentry#1254
• https://forum.sentry.io/t/server-ip-is-displayed-insted-of-client-ip-in-sentry-logback/7534

[IanVS]

Hi @AbhiPrasad. I am currently struggling to get a client IP address passed through to sentry when using a cloudflare worker as a tunnel. I'm setting the x-forwarded-for header in cloudflare, but it has no effect. Instead, I have to modify the actual body (event envelope) itself, as you linked in the first bullet in your answer. That seems to contradict your statement "You can set the IP in the X-Forwarded-For header in the request you send to Sentry". Can you confirm whether maybe this is a bug in the Sentry ingest, or whether it's expected that users should modify the request body when using a tunnel? Thanks!

[AbhiPrasad]

Sentry Ingest attempts to extract either the X-Forwarded-For header https://github.com/getsentry/relay/blob/60d1e4b84cceb606de343e06f1181764a87cee8d/relay-server/src/extractors/forwarded_for.rs#L17C8-L17C28 or the socket address to set as the IP https://github.com/getsentry/relay/blob/60d1e4b84cceb606de343e06f1181764a87cee8d/relay-server/src/extractors/forwarded_for.rs#L50-L53

This is only done if user.ip_address has not been set on the Sentry event ahead of time (and if you allow sentry to store ip_address on events). https://github.com/getsentry/relay/blob/6a7b0734e125c18d8e922cca096651fe4c387f97/relay-server/src/actors/processor.rs#L616-L621

Are you explicitly setting user.ip_address on the event before it's being sent?

Any kind of reproduction of your setup would help a lot for us to dive deeper to figure out whats going on.

[IanVS]

Thanks for the response. No, we do not set user. ip_address explicitly anywhere. Should I be explicitly setting it to "{{auto}}" (or something like that, but I thought that was the default)?

I'll throw together a reproduction as soon as I get a chance.

I've also been talking with Sentry support (Francis Wang) who has been investigating and said:

I've been trying to send an event manually adding the x-forwarded-for header using postman, but I can't get it to work, so I guess I must be doing something wrong.

[AbhiPrasad]

Hey @IanVS seems like we've had a regression on our side - apologies for the trouble. We're investigating this here getsentry/relay#2450

[IanVS]

Great, thanks everyone for looking into it!