<p>When you deploy something via a Docker-container, you have to keep in mind that it's (normally) not-directly-connected to the rest of the world (the Internet, in your case) and that such a connection (container &lt;=&gt; Internet) is mediated by the Docker-host (the PC hosting the docker environment and properly running your container) resulting in a chain that looks like:</p>
<p><code>&lt;your container&gt; &lt;=&gt; &lt;docker host&gt; &lt;=&gt; &lt;Internet&gt;</code></p>
<p>Actually, even if you haven't provided the details, I expect a real scenario like this:</p>
<p><code>&lt;your container&gt; &lt;=&gt; &lt;docker host&gt; &lt;=&gt; &lt;your Internet router&gt; &lt;=&gt; &lt;Internet&gt;</code></p>
<p>Note: <em>this is what happens &quot;commonly&quot;. Lots of edges can be tuned by properly configuring Docker <a href="https://docs.docker.com/network/" rel="nofollow noreferrer">networking parameters</a> to adapt them to your needs. But in general, you can assume the above.</em></p>
<p>So, back to your case, as your container is receiving the HTTP request from the docker-host, this is exactly the reason why you see what you see (the HTTP request coming from the IP of your HOST, and not the one of the real source, on the Internet).</p>
<p>In technical terms, the docker-host is acting --with respect to your container-- as a (sort-of) <a href="https://en.wikipedia.org/wiki/Reverse_proxy" rel="nofollow noreferrer">REVERSE PROXY</a>. In other words:</p>
<ol>
<li>the real source host send the request to your docker-host (to the public IP address associated to the external interface of your docker host);</li>
<li>docker-host receive the request and...</li>
<li>...it &quot;proxy&quot; (actually: &quot;forward&quot;) the request to your container.</li>
</ol>
<p>The above is really common within so-called &quot;cloud environment&quot; and, as such, there are several ways to solve the visibility problem you're facing (knowing the real source IP of the HTTP request you're serving).</p>
<p>In your case, I'd suggest going <a href="https://matomo.org/faq/how-to-install/faq_98/" rel="nofollow noreferrer">through the official document</a> to get un understanding about the whole concept and related countermeasures.</p>
<p>But...</p>
<p>...unfortunately the above is <strong>not</strong> strightly suited to your case as the docker-host is <strong>not</strong> strictly running a REVERSE-PROXY &quot;server&quot;, but, instead, is acting as a PORT-FORWARDER router. Without entering into details (out of scope of this answer), the problem is that you <strong>DON'T</strong> have the place to properly configure the reverse-proxy actions you need.</p>
<p>So, in the end, you have only two options:</p>
<ol>
<li><p>change the docker configuration, asking the docker-host to logically connect your matomo container to the <em>EXTERNAL</em> network, exposing it exactly like any other host on your LAN. Afterwards, you only need to setup your external networking, sending the HTTP traffic to the container IP, and no more the docker-host IP. In other words, the scenario will be:
<code>&lt;your container&gt; &lt;=&gt; &lt;your Internet router&gt; &lt;=&gt; &lt;Internet&gt;</code></p>
</li>
<li><p>on the docker-host, install a real REVERSE-PROXY (like <a href="https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/" rel="nofollow noreferrer">NGINX</a>) and configure it accordingly to matomo documentation mentioned above. In other words, the scenario will be:
<code>&lt;your container&gt; &lt;=&gt; &lt;NGINX Reverse-proxy running on the docker host&gt; &lt;=&gt; &lt;your Internet router&gt; &lt;=&gt; &lt;Internet&gt;</code></p>
</li>
</ol>
<p><em>A final note: I've heavily oversimplified the above description and I'm well aware that is <strong>NOT</strong> 100% correct. But it should be enough to help you solving your problem :-)</em></p>

CC BY-SA 4.0
2021-09-25T16:16:56.853Z
Hello Damiano, thank you very much for using your time to give me such a complete answer. Actually, my problem is that I can't even get the host IP. I always get the docker container IP on each request. It's as if inside the container I can't get the outside information, and I can't figure out if this is a missing apache configuration or if I have to look on the docker side of the thing. Do you have an opinion? Thanks again!
Gigs
CC BY-SA 4.0
2021-09-26T07:37:17.120Z
Please, edit your original post, adding a section with the related networking details (you can obfuscate public IP addresses, if involved). I'm specifically interested in:  1) the IP address of your external default-gateway; 2) the IP address of your docker-host host, both the external one (connecting the host to the def-gw) and the internal lan (the docker-lan one); 3) the IP address of your matomo container. Also if your external LAN is "private", details regarding port-forwarding from def-gw to docker-host, could be useful as well.
Damiano Verzulli
CC BY-SA 4.0
2021-10-04T09:34:12.300Z
Hello Damiano ! I apologize for the delay, I was working on another project. I edited my answer with networking details. My answer is probably not exactly what you're expecting (I'm still learning about network and docker, so I'm not sure about what you're asking me, please tell me if I should provide you another details). Thanks again, I really appreciate your help.
Gigs
CC BY-SA 4.0
2021-09-24T09:01:18.620Z
2021-09-24T09:01:18.620Z
Damiano Verzulli
<p>I've deployed a Matomo application using the official docker image. I'm trying to activate geolocalization (using a plugin) and it's not working.</p>
<p><strong>I can see that Matomo (apache) only gets the docker container IP, instead of client's IP.</strong></p>
<p>I can't figure out if the problem comes from a missing Docker config (yes, I'm a newbie) or from a missing Apache config.</p>
<br>
Some network details
<p>Testing it locally (same behavior as in production env) :</p>
<ol>
<li>IP address of external default-gateway :
<code>192.168.253.254</code></li>
<li>IP address of docker host (from ifconfig command) : <code> 192.168.253.96</code> | docker0 <code>172.17.0.1</code></li>
<li>IP address of matomo container : <code>172.28.0.3</code></li>
</ol>
<p>All visitor's IP are tracked as <code>172.28.0.1</code> (as far as I understand, locally it should be <code>127.0.0.1</code>).</p>
<p>I was wondering if the problem could be related to the docker network config? Matomo app and it's DB are deployed using a same bridge network.</p>

<docker><apache-httpd>
How can I get client IP on apache insted of Docker container IP?
Gigs
# How can I get client IP on apache insted of Docker container IP?

(Asked by: username_0 on 2021-09-21)

I've deployed a Matomo application using the official docker image. I'm trying to activate geolocalization (using a plugin) and it's not working.

**I can see that Matomo (apache) only gets the docker container IP, instead of client's IP.**

I can't figure out if the problem comes from a missing Docker config (yes, I'm a newbie) or from a missing Apache config.

  
Some network details

Testing it locally (same behavior as in production env) :

1. IP address of external default-gateway :
   `192.168.253.254`
2. IP address of docker host (from ifconfig command) :  `192.168.253.96` | docker0 `172.17.0.1`
3. IP address of matomo container : `172.28.0.3`

All visitor's IP are tracked as `172.28.0.1` (as far as I understand, locally it should be `127.0.0.1`).

I was wondering if the problem could be related to the docker network config? Matomo app and it's DB are deployed using a same bridge network.

**Tags:** docker, apache-httpd


---

## 1 answers

### Answer by username_1 on 2021-09-24. Score: 1

When you deploy something via a Docker-container, you have to keep in mind that it's (normally) not-directly-connected to the rest of the world (the Internet, in your case) and that such a connection (container <=> Internet) is mediated by the Docker-host (the PC hosting the docker environment and properly running your container) resulting in a chain that looks like:

`<=>  <=>`

Actually, even if you haven't provided the details, I expect a real scenario like this:

`<=>  <=>  <=>`

Note: *this is what happens "commonly". Lots of edges can be tuned by properly configuring Docker [networking parameters](https://docs.docker.com/network/) to adapt them to your needs. But in general, you can assume the above.*

So, back to your case, as your container is receiving the HTTP request from the docker-host, this is exactly the reason why you see what you see (the HTTP request coming from the IP of your HOST, and not the one of the real source, on the Internet).

In technical terms, the docker-host is acting --with respect to your container-- as a (sort-of) [REVERSE PROXY](https://en.wikipedia.org/wiki/Reverse_proxy). In other words:

1. the real source host send the request to your docker-host (to the public IP address associated to the external interface of your docker host);
2. docker-host receive the request and...
3. ...it "proxy" (actually: "forward") the request to your container.

The above is really common within so-called "cloud environment" and, as such, there are several ways to solve the visibility problem you're facing (knowing the real source IP of the HTTP request you're serving).

In your case, I'd suggest going [through the official document](https://matomo.org/faq/how-to-install/faq_98/) to get un understanding about the whole concept and related countermeasures.

But...

...unfortunately the above is **not** strightly suited to your case as the docker-host is **not** strictly running a REVERSE-PROXY "server", but, instead, is acting as a PORT-FORWARDER router. Without entering into details (out of scope of this answer), the problem is that you **DON'T** have the place to properly configure the reverse-proxy actions you need.

So, in the end, you have only two options:

1. change the docker configuration, asking the docker-host to logically connect your matomo container to the *EXTERNAL* network, exposing it exactly like any other host on your LAN. Afterwards, you only need to setup your external networking, sending the HTTP traffic to the container IP, and no more the docker-host IP. In other words, the scenario will be:
    `<=>  <=>`
2. on the docker-host, install a real REVERSE-PROXY (like [NGINX](https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/)) and configure it accordingly to matomo documentation mentioned above. In other words, the scenario will be:
    `<=>  <=>  <=>`

*A final note: I've heavily oversimplified the above description and I'm well aware that is **NOT** 100% correct. But it should be enough to help you solving your problem :-)*

> **Comments:**
> **username_0**: Hello Damiano, thank you very much for using your time to give me such a complete answer. Actually, my problem is that I can't even get the host IP. I always get the docker container IP on each request. It's as if inside the container I can't get the outside information, and I can't figure out if this is a missing apache configuration or if I have to look on the docker side of the thing. Do you have an opinion? Thanks again!  
> **username_1**: Please, edit your original post, adding a section with the related networking details (you can obfuscate public IP addresses, if involved). I'm specifically interested in:  1) the IP address of your external default-gateway; 2) the IP address of your docker-host host, both the external one (connecting the host to the def-gw) and the internal lan (the docker-lan one); 3) the IP address of your matomo container. Also if your external LAN is "private", details regarding port-forwarding from def-gw to docker-host, could be useful as well.  
> **username_0**: Hello Damiano ! I apologize for the delay, I was working on another project. I edited my answer with networking details. My answer is probably not exactly what you're expecting (I'm still learning about network and docker, so I'm not sure about what you're asking me, please tell me if I should provide you another details). Thanks again, I really appreciate your help.  

---

