CODEWITHSUNDEEP
apacheproxy
omega1
omega1

Reputation: 1052

apache proxy - Pass origin IP address to destination

I am using apache as a proxy server to accept incoming requests on one port and redirect them out to the destination (based on the incoming port) on a different post, as an example of a VirtualHost entry:

<VirtualHost *:444>
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        ProxyPreserveHost On
        ProxyRequests Off
        ServerName mydomain.com
        ServerAlias mydomain.com
        ProxyPass / http://destination_IP:6444/
        ProxyPassReverse / http://destination_IP:6444/
        SSLCertificateFile /etc/letsencrypt/live/mydomain.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

My issue is that when the request reaches the destination server, it appears with my public IP address (the IP address of the apache proxy server), not the original client IP address.

I have tried enabling mod_remoteip with a2enmod remoteip and added the following into the apache2.conf file :

LoadModule remoteip_module modules/mod_remoteip.so

But I am not getting the client IP address forwarded over to the destination server, it still appears as my own (the proxy servers public IP address).

It is not possible for me to modify anything on the destination servers, so I need to resolve on my own proxy server.

How can I pass the clients IP address in this scenario?

Thank you.

Upvotes: 1

Views: 9861

Answers (1)

cyptus
cyptus

Reputation: 3396

You cannot change / fake your remote Ip address to the clients ip address. The connection to the target server will always come from your proxy server, so from the proxy servers ip. Your proxy can pass the original ip from the client in the x-fordwared-for header to the target. It's up to the target to handle this or not.

The mod_remoteip module can be used to tell apache at the target side to not load the ip address from the default header but from the x-fordwared-for header if you enable this.

See also https://stackoverflow.com/a/30784225/1216595

Upvotes: 5

Related Questions