Please wait...

IP detection changes since v2.1.10

When a client connects to MailWizz, it sends various information. This information also contains the user remote address, also known as the user IP address. This IP address is used in various places inside MailWizz, for example, while throttling login requests or when we need to record details about subscribers, campaign opens, clicks, etc.

In a regular web hosting environment, you generally have a web server, such as Nginx or Apache, which will receive requests and forward them to MailWizz (PHP). As you guessed, in this request, the web server also includes the IP address of the client that made the request. When you are under such setup, by default, the IP address that reaches MailWizz, is the IP address of the client making the request, which is perfectly usable for us. This type of setup will suffice for small instances of MailWizz.

However, when you need to scale MailWizz, you most likely will install it on multiple servers, in an internal network, and then put a public load balancer in front of these servers so that clients actually connect to this load balancer and the load balancer will distribute the client requests between all your internal servers. When you are under such setup, by default, the IP address that reaches MailWizz, is the IP address of the load balancer, which would not be usable for us. However, the load balancer also will send a special header, called "X-Forwarded-For" which will contain the IP address of the client, so MailWizz can look at this header and extract the IP address from there.

Beside running under a classic load balancer setup like described above, you could also use a service like Cloudflare as a reverse proxy for your application. The way it works is the client requests will reach Cloudflare, then Cloudflare will proxy the requests to your server. When this happens, the IP address that reaches MailWizz, is the IP address of the Cloudflare server that did the proxy request, which would not be usable for us. However, Cloudflare adds some request headers which we can use in order to find out the real IP address of the client making the request.

As you can see, there are various complex scenarios where MailWizz has to find out the IP address of clients making a request. If you're running a traditional setup, things are simple, but when you run under a load balancer/reverse proxy, things become very complex. Until version 2.1.10, we did our best to automatically detect the IP address based on various request headers. However, it turns out that doing this, allows people with bad intent to send requests with different IP addresses and this is not desirable since we would record wrong IP addresses.

With the changes we introduced in version 2.1.10, MailWizz will not do any automatic detection of the IP address since that would not be reliable. Instead, if you are now running under a load balancer/reverse proxy, you will have to tell MailWizz so that MailWizz will know how to handle incoming requests to extract the right IP address. You do this by going into Backend > Settings > Reverse Proxy. Here you can tell MailWizz if you are running under Cloudflare or a regular load balancer/reverse proxy.

Additionally, when you hit the backend dashboard, MailWizz will look at your request and try to detect if you are running under a reverse proxy or not. It will compare this result with the settings from Backend > Settings > Reverse Proxy and it will inform you in case you have to take additional action. This check is not 100% accurate, so use your best judgement, you know best your hosting environment.

Please note, if you are running under a load balancer/reverse proxy, you will need to properly configure it to forward the client IP address in the right header, that is, "X-Forwarded-For". If you don't do this, MailWizz will record the IP address of the load balancer/reverse proxy instead of the real IP address of the client making the request. And you don't want that.

External resources:
Using the Forwarded header with X-Forwarded-For
How to configure HAProxy to forward client IP details to backend servers?
X-Forwarded-For on developer.mozilla.org
Wiki for X-Forwarded-For header
Cloudflare HTTP request headers