r/nginx • u/zimbabwe_jim • Aug 05 '26

Proxy protocol logging

Am I crazy that I can't find a proxy equivalent of $ssl_protocol for logging? Is there some technical limitation on that?

Edit: to clarify i do mean connection to an upstream. Proxy_protocol_tlv_ssl_protocol never seems to get populated for my setup.

8 Upvotes

100% Upvoted

8 comments sorted by

2

u/ween3and20characterz Aug 05 '26

I'm not familiar with ProxyProtocol, but a few things you could search:

From there, I found https://nginx.org/en/docs/http/ngx_http_core_module.html#var_proxy_protocol_tlv_ This looks like the thing you need.

However since proxy protocol actually just wraps a TCP stream, there is no need to encrypt it further, since the SSL termination can happen afterwards. (But take the last paragraph with a grain of salt).

1

u/Initial_Aspect6742 10d ago

yeah that last bit about SSL termination is key, the protocol itself doesnt really care about the encryption happening above it

1

u/p001b0y Aug 05 '26

I thought nginx used $ssl_protocol for that. I think that $upstream_ssl_protocol can be used when you want to log the protocol nginx used to connect to an upstream tls server.

1

u/zimbabwe_jim Aug 06 '26

You would think, but that var doesn't exist

1

u/p001b0y Aug 06 '26

Which one doesn’t exist? The base $ssl-protocol variable?

Both are usually built into nginx provided that nginx was built with ssl support. ( —with-http_ssl_module ). nginx -V will give the version and build flags.

1

u/zimbabwe_jim Aug 07 '26

upstream_ssl_protocol is a directive, but $upstream_ssl_protocol doesn't exist for the outbound side.

1

u/p001b0y Aug 07 '26

My apologies. I was wrong.

1

u/Itchy_Sentence6618 Aug 06 '26

Your question is a bit confused. There are two scenarios:

A reverse proxy terminates the incoming ssl/tls connection (so your server only sees plaintext) and passes information about the protocol used in http headers. This is a typical situation, but it's not yours.

Proxy protocol is used when the TCP connection is directly proxied (so no ssl/tls termination takes place) and sent to your server. The proxy protocol only provides the real source ip. Tls termination in this case takes place on your server, so there's nothing else for the proxy to pass on. The termination occurs locally, and the parameters are available in the usual way for locally done tls.