CODEWITHSUNDEEP
phpapachehttprequestip-addressportforwarding
mitchdav
mitchdav

Reputation: 705

Get remote IP in PHP / Apache after port forwarding

I have two Windows servers on a client's network, with one server (S1) having a public IP and port forwarding requests to a PHP web application running in Apache on the other server (S2) which has no public IP.

Using PHP and Apache, S2 only sees the remote address of incoming requests as the internal IP of S1.

I would like for S2 to be able to see the actual client's IP address for logging, but after much searching and debugging I haven't been able to get this to work.

A rough sketch of how requests flow in and out of the system is as follows:

request flow chart

S1 does not use any applications (reverse proxy, etc.) to forward on these requests, which means that it cannot append a X-FORWARDED-FOR header (or any of the other proxy headers) to the HTTP request.

A truncated version of the $_SERVER array from phpinfo() is as below:

truncated $_SERVER from phpinfo()

I have found this question whose top answer specifically mentions port forwarding that might be "messing with the packets", which appears to be precisely what is happening in this instance.

Is there any way to see the remote client's IP instead of the IP of S1? Is there a config that can be set in Apache or PHP for this? Or is it in the network layer and thus cannot be resolved in the application layer? I don't have a lot of knowledge about networking here to know what to search for.

Upvotes: 1

Views: 1105

Answers (1)

jhilgeman
jhilgeman

Reputation: 1583

If you're losing the client IP, then it's not really port forwarding. It sounds more like SSL termination where S1 handles the SSL and forwards the decrypted traffic to S2. That kind of interception (not saying it IS that scenario - just sort of like it) will result in the scenario you're seeing.

In this scenario, your best bet is to figure out the specific configuration / technology doing the forwarding and have it copy the original remote IP into the environmental variables for the request to S2. A simple way to do that is to inject the IP into a custom HTTP header so it shows up in your $_SERVER array.

But how that is specifically accomplished is up to the setup on S1, since S1 is rewriting the packets (the IP is stored in the packet header).

Upvotes: 1

Related Questions