Restoring visitors IP with mod_remoteip

Introduction

Sometimes you'll have traffic come from another source such as Cloudflare, another proxy source, or a dedicated firewall. Apache offers mod_remoteip which will allow you to restore the original visitor address.

Procedure

First, install this via yum or through EasyApache and search for ea-apache24-mod_remoteip.

yum install ea-apache24-mod_remoteip

Next, create or modify the configuration file for mod_remoteip.

/etc/apache2/conf.modules.d/370_mod_remoteip.conf

If this is not present, you can create one:

nano /etc/apache2/conf.d/370_mod_remoteip.conf

 
Within this file, you need to configure the address you need to proxy. The contents of the remoteip.conf file will represent your proxy server, if this is using an internal network, you'll use RemoteIPInternalProxy instead of RemoteIPTrustedProxy.

RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 192.168.1.51

RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 192.168.1.51

If there are additional addresses you need to add, you can do this by adding them one after the other.

RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 192.168.1.51 10.10.10.20

Once that has been done, you'll need to go to

• Home »
• Service Configuration »
• Apache Configuration »
• Global Configuration

And modify the log formats.

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combined

This format captures the header with the %h field which is the proxy address in our example. Because we want the originating client IP address instead of the remote IP being logged, you also need to modify LogFormat definition to look as follows:

LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

Save and restart Apache and that should handle this.