Apache Module mod_remoteip

Our internally trusted proxies; 10.0.2.0/24

Identified external proxies;

This module is used to treat the useragent which initiated the request as the originating useragent as identified by httpd for the purposes of authorization and logging, even where that useragent is behind a load balancer, front end server, or proxy server.

The module overrides the client IP address for the connection with the useragent IP address reported in the request header configured with the

Once replaced as instructed, this overridden useragent IP address is then used for the modauthzhost

feature, is reported by Require ip

format strings. The underlying client IP of the connection is available in the %{c}a

Apache by default identifies the useragent with the connection's clientip value, and the connection remotehost and remote_logname are derived from this value. These fields play a role in authentication, authorization and logging and other purposes by other loadable modules.

mod_remoteip overrides the client IP of the connection with the advertised useragent IP as provided by a proxy or load balancer, for the duration of the request. A load balancer might establish a long lived keepalive connection with the server, and each request will have the correct useragent IP, even though the underlying client IP address of the load balancer remains unchanged.

When multiple, comma delimited useragent IP addresses are listed in the header value, they are processed in Right-to-Left order. Processing halts when a given useragent IP address is not trusted to present the preceding IP address. The header field is updated to this remaining list of unconfirmed IP addresses, or if all IP addresses were trusted, this header is removed from the request altogether.

In overriding the client IP, the module stores the list of intermediate hosts in a remoteip-proxy-ip-list note, which

can record using the modlogconfig%{remoteip-proxy-ip-list}n

format token. If the administrator needs to store this as an additional header, this same value can also be recording as a header using the directive

internal (intranet) proxies are registered. | |---|

RemoteIPHeader X-Forwarded-For

RemoteIPInternalProxy proxy-ip|proxy-ip/subnet|hostname ...

RemoteIPHeader X-Client-IP RemoteIPInternalProxy 10.0.2.0/24 RemoteIPInternalProxy gateway.localdomain

' hash character designates a comment line, otherwise each whitespace or newline separated entry is processed identically to the

directive, any intranet or private IP address reported by such proxies, including the 10/8, 172.16/12, 192.168/16, 169.254/16 and 127/8 blocks (or outside of the IPv6 public 2000::/3 block) are not trusted as the useragent IP, and are left in the RemoteIPInternalProxy

192.0.2.16/28 #wap phone group of proxies

proxy.isp.example.com #some well known ISP

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.4

Apache Module mod_remoteip

Available Languages: en | fr

Directives

Remote IP Processing

Apache by default identifies the useragent with the connection's client_ip value, and the connection remote_host and remote_logname are derived from this value. These fields play a role in authentication, authorization and logging and other purposes by other loadable modules.

RemoteIPHeader Directive

The RemoteIPHeader directive triggers mod_remoteip to treat the value of the specified header-field header as the useragent IP address, or list of intermediate useragent IP addresses, subject to further configuration of the RemoteIPInternalProxy and RemoteIPTrustedProxy directives. Unless these othe

RemoteIPInternalProxy Directive

The RemoteIPInternalProxy directive adds one or more addresses (or address blocks) to trust as presenting a valid RemoteIPHeader value of the useragent IP. Unlike the RemoteIPTrustedProxy directive, any IP address presented in this header, including private intranet addresses, are trusted when passe

RemoteIPInternalProxyList Directive

The RemoteIPInternalProxyList directive specifies a file parsed at startup, and builds a list of addresses (or address blocks) to trust as presenting a valid RemoteIPHeader value of the useragent IP.

RemoteIPProxiesHeader Directive

The RemoteIPProxiesHeader directive specifies a header into which mod_remoteip will collect a list of all of the intermediate client IP addresses trusted to resolve the useragent IP of the request. Note that intermediate RemoteIPTrustedProxy addresses are recorded in this header, while any intermedi

RemoteIPTrustedProxy Directive

The RemoteIPTrustedProxy directive adds one or more addresses (or address blocks) to trust as presenting a valid RemoteIPHeader value of the useragent IP. Unlike the RemoteIPInternalProxy directive, any intranet or private IP address reported by such proxies, including the 10/8, 172.16/12, 192.168/1

RemoteIPTrustedProxyList Directive

The RemoteIPTrustedProxyList directive specifies a file parsed at startup, and builds a list of addresses (or address blocks) to trust as presenting a valid RemoteIPHeader value of the useragent IP.