If I have an NGINX server at and in the NGINX server you have the config that forwards on http traffic to

upstream 123 {

server {
    listen 80 default_server;
    location / {
        proxy_pass http://123;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

For an outsider who only knows the address Is it possible for them to find out that the IP address is the one that it is redirected to?


3 Answers 3


If properly configured, then yes, the IP address of the backend server would be hidden. This is the operating principle behind DDoS protection services like Cloudflare: Hide the real server behind a proxy server that can tolerate a large volume of traffic while filtering out bad requests.

That said, if it's imperative that your backend server IP remains hidden then you need to make sure it is not being leaked, either by your web application or by any DNS records that you have. If the backend server is publicly reachable, you should configure its firewall to only accept requests from the proxy server. This will prevent it from being discovered through a scan of all public IP addresses looking for a server that serves the same webpage as your proxy.


I assume you're saying is forwarding all requests to in an attempt to keep the server IP/location anonymous. Correct?

In that case, the user would think they were communicating with As long as you were only serving static html or documents that should be fine. The problem occurs when you throw something which does backend processing into the mix such as PHP. If there's any vulnerability in the PHP which an attacker could leverage to run $_SERVER['SERVER_ADDR']; then the user would see reporting the hidden ip address.

NOTE: I've edited this answer, the earlier answer was incorrect as I misinterpreted this question.

  • Thank you! I actually do have SSL certs. I will update. Yes but only will see the headers? This doesn't mean that someone looking at will be able to discover
    – maxisme
    Apr 23, 2016 at 11:46
  • I think you misunderstood the question. As far as I read it it is about the anonymity of the backend server, not the client.
    – Philipp
    Apr 23, 2016 at 11:46
  • Ah, I see what he means now. That makes a lot more sense.
    – Daisetsu
    Apr 23, 2016 at 16:01
  • I've edited my answer, it should be correct now.
    – Daisetsu
    Apr 23, 2016 at 16:07

Using a reverse proxy in web servers allows you many features. One of these is automatic data traversal to multiple servers through reverse proxies and load balancers. The server should be completely anonymous at this point. The only way the attacker could find out the proxied server is if there was a vulnerability in the framework that allows them to run code that would leak the IP address. This leads to a much bigger question you should try to get answered:

Is my backend server secure against injection attacks?

  • YES: then your backend servers are anonymous
  • No: Then your backend server could be leaked to very determined individuals

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .