$proxy_internal_connection

Description

The variable $proxy_internal_connection is set in the context of processing a proxied request in NGINX when a request is being forwarded to another upstream server. It specifically checks if the outgoing connection uses an internal network, which is determined by whether the socket for the connection is part of the internal routing rules set up in your NGINX configuration. By default, this variable will evaluate to '1' (true) if the outgoing connection is internal and '0' (false) if it is external. This variable is particularly useful in scenarios involving multiple layers of proxying or configurations where security constraints are enforced based on whether connections are internal or external. For instance, if you have rules defined that restrict access or modify headers based on the connection type, this variable can help fine-tune such behaviors. Users can set up specific configurations in their NGINX setup to react differently depending on the value of this variable, enhancing the control over connection handling within proxied requests. Typical usage scenarios might include increased logging, modifying request headers for internal connections but not for external ones, or applying special security measures to protect against exposing certain features over public-facing connections. Logs can then indicate different routing paths based on the status of this variable, allowing for straightforward troubleshooting and performance monitoring.

Config Example

location /proxy {
    proxy_pass http://backend;
    # Log whether the connection is internal or not
    access_log /var/log/nginx/internal_access.log;
    if ($proxy_internal_connection) {
        # Internal requests can have specific handling 
        set $internal 'true';
    }
}