Your frontend CDN (eg. Cloudflare or even your own load balancer/proxy) must be sending the X-Forwarded-For and you must be running Apache on the backend.
This solves the problem where your logs and services will only see the proxy/CDN IP and not the real client IP.

mod_rpaf will fix all of this

This solution transparently sets the real IP of the client for Apache and any services that rely on the REMOTE_ADDR without having to modify any code.
 

Install the right tools:


#install the devel tools and gcc for your distro and git
yum -y install httpd-devel gcc git

 

Get the mod_rpaf source code

#let's git the mod_rpaf module (most distros don't have this as a package installable module) so we have to build it ourselves
cd ~
git clone https://github.com/gnif/mod_rpaf.git
cd mod_rpaf

 

Compile mod_rpaf


#let's compile and install the mod_rpaf.c code
apxs -i -c -n rpaf mod_rpaf.c

 

Edit httpd.conf

#edit the httpd.conf for Apache to enable mod_rpaf, be sure to set the RPAF_ProxyIPs to whatever IPs your CDN/proxy uses otherwise the original CDN IP will still be presented to Apache

Edit the two example of IPs below to be your CDN/Proxy/LoadBalancer IPs (if you only have 1 IP then only put 1 there).

LoadModule rpaf_module modules/mod_rpaf.so


    RPAF_Enable             On
    RPAF_Header             X-Forwarded-For
    RPAF_ProxyIPs           1.2.3.4 5.6.7.8
    RPAF_SetHostName        On
    RPAF_SetHTTPS           On
    RPAF_SetPort            On


 

#remember to restart httpd/apache


systemctl restart httpd
#now remove gcc and httpd-devel and git for security reasons
yum -y remove gcc httpd-devel git

cdn, cloudflare, preserve, ip, modifying, apacheyour, frontend, eg, balancer, proxy, forwarded, apache, backend, solves, logs, mod_rpaf, transparently, rely, remote_addr, modify, install, devel, gcc, distro, git, yum, httpd, module, distros, installable, clone, https, github, gnif, compile, apxs, rpaf, edit, conf, enable, rpaf_proxyips, ips, presented, loadbalancer, loadmodule, rpaf_module, modules, ifmodule, rpaf_enable, rpaf_header, rpaf_sethostname, rpaf_sethttps, rpaf_setport, restart, systemctl,

Latest Articles