Kestrel behind NGINX reverse proxy , cannot get original client ip address - docker

Question

I have a scenario where one kestrel host is behind two (if it makes a difference) nginx proxies, and for the life of me I cannot get HttpContext.Connection.RemoteIpAddress to point to the original client IP address.
By adding some logging right after building the app,
var app = builder.Build();
app.UseCors();
app.UseForwardedHeaders();
app.UseHttpLogging();
app.Use(async (context, next) =>
{
app.Logger.LogInformation("Request RemoteIp: {RemoteIpAddress}",
context.Connection.RemoteIpAddress);
await next(context);
});
I can then see the following output on the console
[18:24:37 INF] Request:
Protocol: HTTP/1.1
Method: GET
Scheme: http
PathBase:
Path: /api/what-is-my-ip
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Connection: keep-alive
Host: --ACTUAL HOSTNAME USED IN URL--
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en;q=0.5
Cookie: [Redacted]
Upgrade-Insecure-Requests: [Redacted]
X-Forwarded-For: --CORRECT-REAL-IP-OF-CLIENT--, 172.18.0.1
X-Forwarded-Proto: http
X-Real-IP: --CORRECT-REAL-IP-OF-CLIENT--
[18:24:37 INF] Request RemoteIp: ::ffff:172.18.0.4
From what I can tell, the X-Forwarded-For header is correct (although I am missing one hop*), but the last line always displays the local ip of the machine that runs Kestrel and completely ignores the X-Forwarded-For header (the first IP address in that list is what I want to access, and from what I understand is where the original client's IP should appear after multiple hops).
*I think I am missing one hop because the requests are routed as follows:
Internet Client
--> Docker host that runs NGINX (172.18.0.1) - 1st proxy_pass
--> Docker container that serves UI with NGINX (172.18.0.3) 2nd proxy_pass
--> Kestrel container (172.18.0.4)
I would expect to finally see an X-Forwarded-For list on Kestrel that contained the 2nd proxy_pass server as well, ie
Original Client IP, 172.18.0.1, 172.18.0.3
Anyhow, if it helps my configuration regarding forwarding are
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
options.ForwardLimit = null;
options.KnownProxies.Add(IPAddress.Parse("172.18.0.1"));
options.KnownProxies.Add(IPAddress.Parse("172.18.0.3"));
}
And both NGINX proxies are setup as such
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection keep-alive;
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
I don't understand what I am doing wrong, unless HttpContext.Connection.RemoteIpAddress is not meant to resolve to the first address of the X-Forwarded-For header when it is present -- but then why on earth do I need to configure the ForwardedHeadersOptions for?!