Log remote IP address when logging in

[yodaphone]

Hi

In my setup (Docker), whenever someone logs in to the server, meshcentral creates a log of the IP address but it logs the local IP of the server instead of the IP address of the source.

i have a caddy reverse proxy, as a binary, running on the same vm with ip 10.0.0.4

is there way to make it log the correct IP address?

7:43:19 AM - admin → Account login from 10.0.0.4, Chrome/133.0.0.0, Windows/10

I tried to set "trustedProxy": "10.0.0.4" in config.json & restarted the containers but it still only logs the 10.0.0.4 IP

[si458]

You should make sure the trustedproxy is set in the settings section of ur config.json and also tell caddy to pass the X-Forwarded-For header, with nginx for example u have to add these lines manually in its config file

Also make sure the ip address is set as ur caddy container ip address if ur using docker

[si458]

Also if u use cloudflare with caddy the ip addresses might be ignored - https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#defaults

[yodaphone]

You should make sure the trustedproxy is set in the settings section of ur config.json and also tell caddy to pass the X-Forwarded-For header, with nginx for example u have to add these lines manually in its config file

Also make sure the ip address is set as ur caddy container ip address if ur using docker

this is my config.json,

{
  "$schema": "http://info.meshcentral.com/downloads/meshcentral-config-schema.json",
  "settings": {
    "cert": "control.foo.com",
    "_maintenanceMode": true,
    "mongoDb": "mongodb://mongodb:27017",
    "_WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "port": 443,
    "_aliasPort": 443,
    "redirPort": 80,
    "_redirAliasPort": 80,
    "AgentPong": 300,
    "TLSOffload": false,
    "SelfUpdate": false,
    "AllowFraming": "false",
    "wsCompression": true,
    "agentWsCompression": true,
    "desktopMultiplex": true,
    "InterUserMessaging": [ "user//admin" ],
    "manageAllDeviceGroups": [ "user//admin" ],
    "ManageCrossDomain": ["user//admin"],
    "WebRTC": "false",
    "AutoBackup": {
      "backupPath": "/opt/meshcentral/meshcentral-backups",
      "backupInvervalHours": "24",
      "keepLastDaysBackup": "10",
      "zippassword": "tpM#%xxxx",
    "trustedProxy": "10.0.0.4"
    },

[si458]

your config.json is invalid
use www.jsonlint.com to format it so its readable
you have put trustedproxy inside of autobackup when it should be under settings

[yodaphone]

Also if u use cloudflare with caddy the ip addresses might be ignored - https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#defaults

yes, cloudflare is my DNS provider & i have a DNS record for the public IP of the VM.

or this is valid for cloudflare tunnels only?

[si458]

plz refer to my above comment

your config.json is invalid
use www.jsonlint.com to format it so its readable
you have put trustedproxy inside of autobackup when it should be under settings

[yodaphone]

@si458

I was able to get this working and it was reporting the correct IP. Now when i try to register a new machine, it doesnt connect. i stopped the windows service and ran

meshagent.exe run
& I'm getting these errors

Connecting to: wss://meshcentral.foo.com:443/agent.ashx
Protocol Error encountered...
Protocol Error encountered...
Protocol Error encountered...
Protocol Error encountered...
Mesh Server Connection Error [1180]+

I then removed all settings for "trustedproxy" & now I'm able to register the windows machine, but I'm back to it reporting the 10.0.0.4 IP

Is there anything else i can do to get this working? what other logs can I provide

These are all my files

this is my caddyfile

meshcentral.foo.com {
        reverse_proxy https://10.0.0.4:8086 {
                trusted_proxies 173.245.48.0/20
                trusted_proxies 103.21.244.0/22
                trusted_proxies 103.22.200.0/22
                trusted_proxies 103.31.4.0/22
                trusted_proxies 141.101.64.0/18
                trusted_proxies 108.162.192.0/18
                trusted_proxies 190.93.240.0/20
                trusted_proxies 188.114.96.0/20
                trusted_proxies 197.234.240.0/22
                trusted_proxies 198.41.128.0/17
                trusted_proxies 162.158.0.0/15
                trusted_proxies 104.16.0.0/13
                trusted_proxies 104.24.0.0/14
                trusted_proxies 172.64.0.0/13
                trusted_proxies 131.0.72.0/22
                header_up Host {host}
                header_up X-Real-IP {remote_host}
                header_up X-Forwarded-For {remote_hot}
                transport http {
                        tls
                        tls_insecure_skip_verify
                }
        }
}

my docker compose

services:
 mongodb:
    container_name: meshcentral_db
    restart: always
    image: mongo:latest
    ports:
      - 27017:27017
    volumes:
        - './database:/data/db'

    networks:
      - meshcentral-nw

 meshcentral:
    restart: always
    container_name: meshcentral
    depends_on:
        - 'mongodb'
    image: ghcr.io/ylianst/meshcentral:latest
    ports:
        - 8086:443  
    environment:
        - NODE_ENV=production
        - BACKUPS_PW=xxxxxxx 
        - BACKUP_INTERVAL=24
        - BACKUP_KEEP_DAYS=10
    volumes:
        - ./meshcentral/data:/opt/meshcentral/meshcentral-data    
        - ./meshcentral/user_files:/opt/meshcentral/meshcentral-files   
        - ./meshcentral/backups:/opt/meshcentral/meshcentral-backups   

    networks:
      - meshcentral-nw

networks:
  meshcentral-nw:

my config.json

{
    "$schema": "http://info.meshcentral.com/downloads/meshcentral-config-schema.json",
    "settings": {
        "cert": "meshcentral.foo.com",
        "_maintenanceMode": true,
        "trustedProxy": "10.0.0.4",
        "mongoDb": "mongodb://mongodb:27017",
        "_WANonly": true,
        "_LANonly": true,
        "_sessionKey": "MyReallySecretPassword1",
        "port": 443,
        "_aliasPort": 443,
        "redirPort": 80,
        "_redirAliasPort": 80,
        "AgentPong": 300,
        "TLSOffload": false,
        "SelfUpdate": false,
        "AllowFraming": "false",
        "wsCompression": true,
        "agentWsCompression": true,
        "desktopMultiplex": true,
        "InterUserMessaging": [
            "user//admin"
        ],
        "manageAllDeviceGroups": [
            "user//admin"
        ],
        "ManageCrossDomain": [
            "user//admin"
        ],
        "WebRTC": "false",
        "AutoBackup": {
            "backupPath": "/opt/meshcentral/meshcentral-backups",
            "backupInvervalHours": "24",
            "keepLastDaysBackup": "10",
            "zippassword": "txxxxxxxxxx"
        },
        "maxInvalidLogin": {
            "time": 10,
            "count": 5,
            "coolofftime": 10
        }
    },
    "domains": {
        "": {
            "title": "MeshCentral",
            "title2": "TM",
            "TitlePicture": "smalllogo.png",
            "loginPicture": "logo.png",
            "_minify": true,
            "NewAccounts": "false",
            "_userNameIsEmail": true,
            "certUrl": "https://meshcentral.foo.com:443",
            "clipboardGet": true,
            "clipboardSet": true,
            "_localSessionRecording": false,
            "passwordRequirements": {
                "force2factor": true,
                "_skip2factor": "127.0.0.1,192.168.1.0/24",
                "oldPasswordBan": 5,
                "banCommonPasswords": false,
                "twoFactorTimeout": 300
            }
        }
    },
    "sendgrid": {
        "from": "user@foo.com",
        "apikey": "SG.XXXXXX",
        "verifyemail": false
    }
}

[yodaphone]

Figured it out an was able to get this done