set nx_forward_ip to off