Help Center> Elastic Load Balance> FAQ> Obtaining Source IP Addresses> How Can I Obtain the IP Address of a Client?
View PDF

How Can I Obtain the IP Address of a Client?

Constraints

  • If Network Address Translation (NAT) or Web Application Firewall (WAF) is used, you cannot obtain the IP addresses of the clients.
  • If the client is a container, you can obtain only the IP address of the node where the container is located, but cannot obtain the IP address of the container.
  • If the Obtain Client IP Address option is enabled for TCP or UDP listeners, a cloud server cannot be used as a backend server and a client at the same time. In this case, you can configure the TOA plug-in to obtain the source IP addresses.
  • By default, the Obtain Client IP Address option is enabled for TCP and UDP listeners of dedicated load balancers. You do not need to manually enable it.

Layer 7 Load Balancing

Configure the application server and obtain the IP address of a client from the HTTP header.

The real IP address is placed in the X-Forwarded-For header field by the load balancer in the following format:

X-Forwarded-For: IP address of the client,Proxy server 1-IP address,Proxy server 2-IP address,...

If you use this method, the first IP address obtained is the IP address of the client.

Apache Server

  1. Install Apache 2.4.

    For example, if CentOS 7.5 is used as the OS, run the following command to install the software:

    yum install httpd
  2. Add the following content to the end of Apache configuration file /etc/httpd/conf/httpd.conf: 
    LoadModule remoteip_module modules/mod_remoteip.so
RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 100.125.0.0/16
    Figure 1 Content to be added

    Set the value of RemoteIPInternalProxy to the IP address ranges of the proxy servers, for example, the IP address range used by the AAD service and 100.125.0.0/16 used by ELB. Use a comma (,) to separate multiple entries.

    For dedicated load balancers, the CIDR block of the subnet where the load balancer resides must be added.

  3. Change the log output format in the Apache configuration file to the following (%a indicates the source IP address): 
    LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
  4. Restart Apache. 
    systemctl restart httpd
  5. Obtain the actual IP address of the client from the httpd access logs.

Nginx Server

For example, if CentOS 7.5 is used as the OS, run the following command to install the software:

  1. Run the following commands to install http_realip_module: 
    yum -y install gcc pcre pcre-devel zlib zlib-devel openssl openssl-devel
wget http://nginx.org/download/nginx-1.17.0.tar.gz
tar zxvf nginx-1.17.0.tar.gz
cd nginx-1.17.0
./configure --prefix=/path/server/nginx --with-http_stub_status_module --without-http-cache --with-http_ssl_module --with-http_realip_module
make
make install
  2. Run the following command to open the nginx.conf file: 
    vi /path/server/nginx/conf/nginx.conf
  3. Add the following content under http or server: 
    ;100.125.0.0/16set_real_ip_from 
real_ip_header X-Forwarded-For;
    Figure 2 Content you want to add

    Set the value of set_real_ip_from to the IP address ranges of the proxy servers, for example, the IP address range used by the AAD service and 100.125.0.0/16 used by ELB. Use a comma (,) to separate multiple entries.

  4. Start Nginx. 
    /path/server/nginx/sbin/nginx
  5. Obtain the actual IP address of the client from the Nginx access logs. 
    cat /path/server/nginx/logs/access.log

Tomcat Servers

In the following operations, the Tomcat installation path is /usr/tomcat/tomcat8/.

  1. Log in to a server on which Tomcat is installed.
  2. Check whether Tomcat is running properly. 
    ps -ef|grep tomcat
netstat -anpt|grep java
    Figure 3 Tomcat running properly
  3. Add the following configuration items to the server.xml file: 
    <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log." suffix=".txt"
pattern="%{X-FORWARDED-FOR}i %l %u %t %r %s %b %D %q %{User-Agent}i %T" resolveHosts="false" />
    Figure 4 Example configuration
  4. Restart the Tomcat service. 
    cd /usr/tomcat/tomcat8/bin && sh startup.sh

    In this command, /usr/tomcat/tomcat8/ is the Tomcat installation path. Change it based on site requirements.

    Figure 5 Restarting the Tomcat service
  5. View the latest logs.

    As highlighted in the following figure, IP addresses that are not in the IP address range starting with 100.125 are the source IP addresses.

    cat localhost_access_log..2020-09-10.txt

    In this command, localhost_access_log..2020-09-10.txt indicates the log path of the current day. Change it based on site requirements.

    Figure 6 Querying the source IP address

Windows Server with IIS Deployed

The following uses Windows Server 2012 with IIS7 as an example to describe how to obtain the source IP address.

  1. Download and install IIS.

    https://www.microsoft.com/en-us/download/confirmation.aspx?id=1038

  2. Download the F5XForwardedFor.dll plug-in and copy the plug-ins in the x86 and x64 directories to a directory for which IIS has the access permission, for example, C:\F5XForwardedFor2008.
  3. Open the Server Manager and choose Modules > Configure Native Modules.
    Figure 7 Selecting modules
    Figure 8 Configure Native Modules
  4. Click Register to register the x86 and x64 plug-ins.
    Figure 9 Registering plug-ins
  5. In the Modules dialog box, verify that the registered plug-ins are displayed in the list.
    Figure 10 Confirming the registration
  6. Select ISAPI Filters on the Server Manager homepage and authorize two plug-ins to run ISAPI and CGI extensions.
    Figure 11 Adding authorization
  7. Select ISAPI and CGI Restriction to set the execution permission for the two plug-ins.
    Figure 12 Allowing the plug-ins to execute
  8. Click Restart on the homepage to restart IIS. The configuration will take effect after the restart.
    Figure 13 Restarting IIS

Layer 4 Load Balancing

For load balancing at Layer 4 (TCP or UDP listeners), use either of the following methods to obtain the real IP address of a client:

  • Method 1 (for TCP or UDP listeners): Enable the option of obtaining IP addresses of the clients.
    • Xen ECSs do not support this function. For details about ECS flavors, see x86 ECS Specifications.
    • BMSs do not support this function.
    • After this function is enabled, traffic, such as unidirectional download or push traffic, may be interrupted when backend servers are being migrated during the migration of the associated classic load balancer. After backend servers are migrated, retransmit the packets to restore the traffic.
    • After this function is enabled, the associated backend servers cannot be used as clients to access the listener.
    • If a backend server has been associated with the listener and health checks are enabled, enabling this function will check the health of the backend server, and traffic to this server will be interrupted for two health check intervals.
    • To ensure that backend servers can be directly accessed by the clients, security rules for the backend servers must allow access from IP addresses of the clients, including the security group, network ACL, and OS and software security rules.
    1. Perform the following steps to enable the function:
      1. Log in to the management console.
      2. In the upper left corner of the page, click and select the desired region and project.
      3. Click Service List. Under Network, click Elastic Load Balance.
      4. On the Load Balancers page, click the name of the load balancer.
      5. Click Listeners.
        • To add a listener, click Add Listener.
        • To modify a listener, locate the listener and click on the right of its name.
      6. Enable Obtain Client IP Address.
        Figure 14 Enabling the function
    2. Configure security groups, network ACLs, and OS and software security policies so that IP addresses of the clients can access these backend servers.
      • If you enable the Obtain Client IP Address option, the load balancer use real IP addresses to communicate with backend servers, instead of the IP addresses in the 100.125.0.0/16 IP address range. To ensure that all clients can access the backend servers, configure security group rules of the backend servers to allow all traffic and configure access control to ensure security.
      • If you enable the Obtain Client IP Address option, a server cannot be used as both the client and the backend server.

        If the client and the backend server use the same server and the Obtain Client IP Address option is enabled, the backend server will think the packet from the client is sent by itself and will not return a response packet to the load balancer. As a result, the return traffic will be interrupted.

        In this case, you can use Method 2 to obtain the source IP addresses.

  • Method 2 (for TCP listeners): Configure the TOA plug-in.

    TCP listeners require the plug-in to obtain real IP addresses. For details, see Configuring the TOA Plug-in.