nginx real_ip, and the header you must not trust

Behind a proxy, $remote_addr is the proxy. Reading X-Forwarded-For instead is correct only if you also refuse to believe it from anyone but the proxy.

set_real_ip_from 10.0.0.0/8;        # the load balancer, and only it
set_real_ip_from 172.16.0.0/12;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

# without set_real_ip_from, a client sends its own header and
# your rate limiting, geoblocking and audit log all believe it.

This matters for anything that acts on the client address: rate limits, fail2ban rules reading the access log, and the IP recorded next to a login. Trusting the header unconditionally means an attacker chooses what you log. real_ip_recursive walks the chain from the right, skipping trusted addresses, which is what gets the real client when there are two proxies — a CDN in front of a load balancer being the usual case.