CDN Cloudflare how to set and preserve the real IP of the client without modifying application code on Apache
Your frontend CDN (eg. Cloudflare or even your own load balancer/proxy) must be sending the X-Forwarded-For and you must be running Apache on the backend.
This solves the problem where your logs and services will only see the proxy/CDN IP and not the real client IP.
mod_rpaf will fix all of this
This solution transparently sets the real IP of the client for Apache and any services that rely on the REMOTE_ADDR without having to modify any code.
Install the right tools:
#install the devel tools and gcc for your distro and git
yum -y install httpd-devel gcc git
Get the mod_rpaf source code
#let's git the mod_rpaf module (most distros don't have this as a package installable module) so we have to build it ourselves
cd ~
git clone https://github.com/gnif/mod_rpaf.git
cd mod_rpaf
Compile mod_rpaf
#let's compile and install the mod_rpaf.c code
apxs -i -c -n rpaf mod_rpaf.c
Edit httpd.conf
#edit the httpd.conf for Apache to enable mod_rpaf, be sure to set the RPAF_ProxyIPs to whatever IPs your CDN/proxy uses otherwise the original CDN IP will still be presented to Apache
Edit the two example of IPs below to be your CDN/Proxy/LoadBalancer IPs (if you only have 1 IP then only put 1 there).
LoadModule rpaf_module modules/mod_rpaf.so
RPAF_Enable On
RPAF_Header X-Forwarded-For
RPAF_ProxyIPs 1.2.3.4 5.6.7.8
RPAF_SetHostName On
RPAF_SetHTTPS On
RPAF_SetPort On
#remember to restart httpd/apache
systemctl restart httpd
#now remove gcc and httpd-devel and git for security reasons
yum -y remove gcc httpd-devel git
Tags:
cdn, cloudflare, preserve, ip, modifying, apacheyour, frontend, eg, balancer, proxy, forwarded, apache, backend, solves, logs, mod_rpaf, transparently, rely, remote_addr, modify, install, devel, gcc, distro, git, yum, httpd, module, distros, installable, clone, https, github, gnif, compile, apxs, rpaf, edit, conf, enable, rpaf_proxyips, ips, presented, loadbalancer, loadmodule, rpaf_module, modules, ifmodule, rpaf_enable, rpaf_header, rpaf_sethostname, rpaf_sethttps, rpaf_setport, restart, systemctl,