How Can I Transfer the IP Address of a Client?

When you use ELB to route requests to backend servers, IP addresses of the clients will be translated by the ELB. This FAQ guides you to obtain the IP addresses of the clients.

• Load balancing at Layer 7 (HTTP or HTTPS listeners): Configure the application server and obtain the IP address of a client from the HTTP header.

  For details, see Layer 7 Load Balancing.

• Load balancing at Layer 4 (TCP or UDP listeners): Use either of the following methods to obtain the real IP address of a client.
  • Method 1: Enable Transfer Client IP Address for the listeners.
  • Method 2: Configure the TOA plug-in.

  For details, see Layer 4 Load Balancing.

If both WAF and ELB are used, you can also obtain the IP addresses of the clients through WAF. For details, see Web Application Firewall User Guide.

The real IP address is placed in the X-Forwarded-For header field by the load balancer in the following format:

X-Forwarded-For: IP address of the client,Proxy server 1-IP address,Proxy server 2-IP address,...

If you use this method, the first IP address obtained is the IP address of the client.

Apache Server

1. Install Apache 2.4.

   For example, if CentOS 7.5 is used as the OS, run the following command to install the software:

   yum install httpd

2. Add the following content to the end of Apache configuration file /etc/httpd/conf/httpd.conf:

   LoadModule remoteip_module modules/mod_remoteip.so
   RemoteIPHeader X-Forwarded-For
   RemoteIPInternalProxy 100.125.0.0/16

   Figure 1 Content to be added
   
   

   Add the IP address range of the proxy server after RemoteIPInternalProxy.

   • Shared load balancers: 100.125.0.0/16 and the IP address range used by the AAD service. Load balancers use IP addresses in 100.125.0.0/16 to communicate with backend servers, and there are no security risks. Use commas (,) to separate multiple entries.
   • Dedicated load balancers: CIDR block of the subnet where the load balancer resides
3. Change the log output format in the Apache configuration file to the following (%a indicates the source IP address):

   LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

4. Restart Apache.

   systemctl restart httpd

5. Obtain the actual IP address of the client from the httpd access logs.

Nginx Server

For example, if CentOS 7.5 is used as the OS, run the following command to install the software:

1. Run the following commands to install http_realip_module:

   yum -y install gcc pcre pcre-devel zlib zlib-devel openssl openssl-devel
   wget http://nginx.org/download/nginx-1.17.0.tar.gz
   tar zxvf nginx-1.17.0.tar.gz
   cd nginx-1.17.0
   ./configure --prefix=/path/server/nginx --with-http_stub_status_module --without-http-cache --with-http_ssl_module --with-http_realip_module
   make
   make install

2. Run the following command to open the nginx.conf file:

   vi /path/server/nginx/conf/nginx.conf

3. Add new fields and information to the end of the following configuration information:

   Add the following information under http or server:

   set_real_ip_from 100.125.0.0/16;
   real_ip_header X-Forwarded-For;

   Figure 2 Adding information
   
   

   Add the IP address range of the proxy server after RemoteIPInternalProxy.

   • Shared load balancers: 100.125.0.0/16 and the IP address range used by the AAD service. Load balancers use IP addresses in 100.125.0.0/16 to communicate with backend servers, and there are no security risks. Use commas (,) to separate multiple entries.
   • Dedicated load balancers: CIDR block of the subnet where the load balancer resides
4. Start Nginx.

   /path/server/nginx/sbin/nginx

5. Obtain the actual IP address of the client from the Nginx access logs.

   cat /path/server/nginx/logs/access.log

Tomcat Servers

In the following operations, the Tomcat installation path is /usr/tomcat/tomcat8/.

1. Log in to a server on which Tomcat is installed.
2. Check whether Tomcat is running properly.

   ps -ef|grep tomcat
   netstat -anpt|grep java

   Figure 3 Tomcat running properly
   
3. Modify className="org.apache.catalina.valves.AccessLogValve" in the server.xml file as follows:

   vim /usr/tomcat/tomcat8/conf/server.xml

   <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
   prefix="localhost_access_log." suffix=".txt"
   pattern="%{X-FORWARDED-FOR}i %l %u %t %r %s %b %D %q %{User-Agent}i %T" resolveHosts="false" />

   Figure 4 Example configuration
   
4. Restart the Tomcat service.

   cd /usr/tomcat/tomcat8/bin && sh shutdown.sh && sh startup.sh

   /usr/tomcat/tomcat8/ is where Tomcat is installed. Change it based on site requirements.

   Figure 5 Restarting the Tomcat service
   
5. View the latest logs.

   As highlighted in the following figure, IP addresses that are not in the IP address range starting with 100.125 are the source IP addresses.

   cd /usr/tomcat/tomcat8/logs/
   cat localhost_access_log..2021-11-29.txt

   In this command, localhost_access_log..2021-11-29.txt indicates the log path of the current day. Change it based on site requirements.

   Figure 6 Querying the source IP address
   

Windows Server with IIS Deployed

The following uses Windows Server 2012 with IIS7 as an example to describe how to obtain the source IP address.

1. Download and install IIS.
2. Download the F5XForwardedFor.dll plug-in and copy the plug-ins in the x86 and x64 directories to a directory for which IIS has the access permission, for example, C:\F5XForwardedFor2008.
3. Open the Server Manager and choose Modules > Configure Native Modules.
   Figure 7 Selecting modules
   
   Figure 8 Configure Native Modules
   
4. Click Register to register the x86 and x64 plug-ins.
   Figure 9 Registering plug-ins
   
5. In the Modules dialog box, verify that the registered plug-ins are displayed in the list.
   Figure 10 Confirming the registration
   
6. Select ISAPI Filters on the Server Manager homepage and authorize two plug-ins to run ISAPI and CGI extensions.
   Figure 11 Adding authorization
   
7. Select ISAPI and CGI Restriction to set the execution permission for the two plug-ins.
   Figure 12 Allowing the plug-ins to execute
   
8. Click Restart on the homepage to restart IIS. The configuration will take effect after the restart.
   Figure 13 Restarting IIS