All Products
Search

This Product

    Web Application Firewall:Retrieve the originating IP addresses of clients

    Document Center

    Web Application Firewall:Retrieve the originating IP addresses of clients

    Last Updated:Mar 31, 2026

    After you add your website to Web Application Firewall (WAF), WAF filters incoming requests and forwards normal traffic to your origin server. Because WAF acts as an intermediate proxy, the origin server receives the WAF back-to-origin IP rather than the client's real IP. This topic explains how to configure your web server or Kubernetes container to extract the client's originating IP address from the X-Forwarded-For header.

    Jump to your server type: NGINX | IIS 6 | IIS 7 | Apache | Tomcat | Kubernetes

    How it works

    WAF inserts the client IP into the X-Forwarded-For request header before forwarding the request to your origin server:

    X-Forwarded-For: <client IP>

    When requests pass through multiple proxies — such as WAF, Anti-DDoS Pro or Anti-DDoS Premium, and Alibaba Cloud CDN — each proxy appends its address. The header records a comma-separated chain:

    X-Forwarded-For: <client IP>, <proxy 1 IP>, <proxy 2 IP>, <proxy 3 IP>, ...

    The leftmost value is always the originating client IP.

    Prerequisites

    Before you begin, make sure you have:

    Configure NGINX servers

    NGINX uses the http_realip_module to read the real client IP from the X-Forwarded-For header.

    Step 1: Install http_realip_module

    Check whether the module is already installed:

    nginx -V | grep http_realip_module

    If the module appears in the output, skip to Step 2. If not, recompile NGINX with the module.

    The module is not included when NGINX is installed using a quick installation package.
    wget http://nginx.org/download/nginx-1.12.2.tar.gz
tar zxvf nginx-1.12.2.tar.gz
cd nginx-1.12.2
./configure --user=www --group=www --prefix=/alidata/server/nginx \
  --with-http_stub_status_module \
  --without-http-cache \
  --with-http_ssl_module \
  --with-http_realip_module
make
make install
kill -USR2 `cat /alidata/server/nginx/logs/nginx.pid`
kill -QUIT `cat /alidata/server/nginx/logs/nginx.pid.oldbin`

    Step 2: Update the server configuration

    1. Open default.conf.

    2. Add the following directives inside the location / {} block. Replace <ip_range1> through <ip_rangex> with the WAF back-to-origin CIDR blocks. Enter one CIDR block per line.

      set_real_ip_from <ip_range1>;
set_real_ip_from <ip_range2>;
...
set_real_ip_from <ip_rangex>;
real_ip_header X-Forwarded-For;

      Example with three CIDR blocks:

      set_real_ip_from 10.0.0.1;
set_real_ip_from 10.0.0.2;
set_real_ip_from 10.0.0.3;
real_ip_header X-Forwarded-For;

    Step 3: Update the log format

    1. Open nginx.conf and find the log_format directive in the http block.

    2. Replace $remote_addr with $http_x_forwarded_for so logs record the client's originating IP.

      log_format main '$http_x_forwarded_for - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent"';

    Step 4: Reload NGINX

    nginx -s reload

    Configure IIS 6 servers

    IIS 6 uses the F5XForwardedFor module to retrieve the client's originating IP.

    1. Copy F5XForwardedFor.dll from the x86\Release or x64\Release directory to a custom directory, such as C:\ISAPIFilters\x86 or C:\ISAPIFilters\x64.

      - Make sure the Internet Information Services (IIS) process has read and write permissions on the directory. - If the file is not in the release directory, download F5XForwardedFor.dll and copy it to the directory.

    2. Open IIS Manager, right-click your website, and select Properties.

    3. On the ISAPI Filters tab, click Add and set the following parameters (example for a 32-bit OS):

      ParameterValue
      Filter namex_forwarded_for_x86
      ExecutableFull path to F5XForwardedFor.dll, for example C:\ISAPIFilters\x86\F5XForwardedFor.dll

    4. Click OK, then restart the IIS 6 server for the changes to take effect.

    Configure IIS 7 servers

    IIS 7 uses the F5XForwardedFor module to retrieve the client's originating IP.

    1. Copy F5XFFHttpModule.dll and F5XFFHttpModule.ini from the x86\Release or x64\Release directory to a custom directory, such as C:\x_forwarded_for\x86 or C:\x_forwarded_for\x64.

      - Make sure the IIS process has read and write permissions on the directory. - If the files are not in the release directory, download F5XForwardedFor and copy them to the directory.

    2. In IIS Manager, double-click Modules.

    3. In the Actions panel, click Configure Local Module, then click Register.

    4. Register the module with the following parameters (example for a 32-bit OS):

      ParameterValue
      Namex_forwarded_for_x86
      PathFull path to F5XFFHttpModule.dll, for example C:\x_forwarded_for\x86\F5XFFHttpModule.dll

    5. In the Configure Local Module dialog box, select the newly registered module and click OK.

    6. In the ISAPI and CGI Restrictions section, add the registered DLL and set Restriction to Allow.

    7. Restart the IIS 7 server for the changes to take effect.

    Configure Apache servers

    Apache on Windows

    Apache 2.4 and later includes mod_remoteip.so, which reads the real client IP from the X-Forwarded-For header.

    1. Create conf/extra/httpd-remoteip.conf.

      Using a separate configuration file reduces direct edits to httpd.conf and avoids service disruptions from misconfigurations.

    2. Add the following content to httpd-remoteip.conf. Replace <ip_range1> through <ip_rangex> with the WAF back-to-origin CIDR blocks, separated by spaces.

      # Load the mod_remoteip.so module.
LoadModule remoteip_module modules/mod_remoteip.so
# Configure the RemoteIPHeader header.
RemoteIPHeader X-Forwarded-For
# Specify the back-to-origin CIDR blocks.
RemoteIPInternalProxy <ip_range1> <ip_range2> ... <ip_rangex>

      Example with three CIDR blocks:

      RemoteIPInternalProxy 10.0.0.1 10.0.0.2 10.0.0.3

    3. Add the following line to conf/httpd.conf to load the new configuration file:

      Include conf/extra/httpd-remoteip.conf

    4. Update the log format in httpd.conf to use %a, which records the remote IP resolved by mod_remoteip:

      LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%a %l %u %t \"%r\" %>s %b" common

    5. Restart Apache for the changes to take effect.

    Apache on Linux

    Apache 2.4 and later: remoteip_module is built in. Follow the same steps as for Apache on Windows.

    Apache earlier than 2.4: Install the third-party mod_rpaf module.

    1. Install mod_rpaf:

      wget https://github.com/gnif/mod_rpaf/archive/v0.6.0.tar.gz
tar zxvf mod_rpaf-0.6.tar.gz
cd mod_rpaf-0.6
/alidata/server/httpd/bin/apxs -i -c -n mod_rpaf-2.0.so mod_rpaf-2.0.c

    2. Append the following to /alidata/server/httpd/conf/httpd.conf. For RPAFproxy_ips, use the mod_rpaf module IPs from your Apache logs — not the WAF proxy server IPs. In most cases, two IP addresses are listed.

      LoadModule rpaf_module modules/mod_rpaf-2.0.so
RPAFenable On
RPAFsethostname On
RPAFproxy_ips 10.XX.XX.65 10.XX.XX.131
RPAFheader X-Forwarded-For

    3. Restart Apache:

      /alidata/server/httpd/bin/apachectl restart

    For details on Apache mod_remoteip, see the Apache module documentation.

    Configure Tomcat servers

    Tomcat reads the client IP from the X-Forwarded-For header through its AccessLogValve.

    1. Open tomcat/conf/server.xml.

    2. Update the AccessLogValve entry to log %{X-FORWARDED-FOR}i instead of the default remote host:

      <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
       prefix="localhost_access_log." suffix=".txt"
       pattern="%{X-FORWARDED-FOR}i %l %u %t %r %s %b %D %q %{User-Agent}i %T"
       resolveHosts="false"/>

    Configure Kubernetes containers

    When your origin server runs in Kubernetes, the Ingress controller stores the originating client IP in X-Original-Forwarded-For and WAF's back-to-origin IPs in X-Forwarded-For. To restore the originating IP to X-Forwarded-For, update the Ingress controller configuration.

    1. Edit the kube-system/nginx-configuration ConfigMap:

      kubectl -n kube-system edit cm nginx-configuration

    2. Add the following keys:

      compute-full-forwarded-for: "true"
forwarded-for-header: "X-Forwarded-For"
use-forwarded-headers: "true"

    3. Save the file. The changes take effect immediately — no restart required.

    4. Update your application to read the originating client IP from the X-Original-Forwarded-For header instead of X-Forwarded-For.

    What's next