Retrieve the client IP on a backend server

Nginx server

This topic uses an Nginx server running Alibaba Cloud Linux 3.2104 and nginx/1.20.1 as an example. The actual configuration may vary depending on your environment.

Nginx uses the http_realip_module module to parse the X-Forwarded-For header and retrieve the real client IP.

1. Verify that the module is installed: On the server, run the nginx -V 2>&1 | grep --color=auto http_realip_module command. If the output contains --with-http_realip_module, the module is installed.

   

   For mainstream Linux distributions, Nginx installed through a package manager such as yum or apt usually includes this module by default. If the module is not installed, we recommend that you install or upgrade Nginx using a package manager.

2. Modify the Nginx configuration file: Run sudo nginx -t to find the path to the configuration file. The default path is typically /etc/nginx/nginx.conf.

   http {
       # Ensure the log format includes $http_x_forwarded_for to record the value of the X-Forwarded-For header.
       log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for"';    
       # Ensure the access log uses the preceding log format.             
       access_log  /var/log/nginx/access.log  main;
       #  ...
   }

3. Reload the configuration: Run sudo nginx -t to check the configuration syntax. If the syntax is correct, run sudo nginx -s reload to apply the changes.

Apache server

This topic uses an Apache server running Alibaba Cloud Linux 3.2104 and Apache/2.4.37 as an example. The actual configuration may vary depending on your environment.

Apache uses the mod_remoteip module to parse the X-Forwarded-For header and retrieve the real client IP.

1. Verify that the module is installed: On the server, run the httpd -M | grep remoteip_module command. If the output contains remoteip_module (shared), the module is installed.

   

   For mainstream Linux distributions, Apache installed through a package manager such as yum or apt usually includes this module by default. If the module is not installed, we recommend that you install or upgrade Apache using a package manager.

2. Modify the Apache configuration file: Run httpd -V to find the path to the configuration file. The default path is typically /etc/httpd/conf/httpd.conf.

   # ...
   <IfModule log_config_module>
   # ...
   # Ensure the log format includes %{X-Forwarded-For}i to record the value of the X-Forwarded-For header.
   LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{X-Forwarded-For}i" combined
   # ...
   # Ensure the access log uses the preceding log format.
   CustomLog "logs/access_log" combined
   </IfModule>
   # ...

3. Reload the configuration: Run sudo systemctl restart httpd to apply the changes.

IIS server

This topic uses an IIS server running Windows Server 2022 21H2 and IIS 10.0 as an example. The actual configuration may vary depending on your environment.

1. In the Connections pane of IIS Manager, select the target server. In the main pane, double-click Logging.

   

2. In the Log File section, click Select Fields.

   

3. In the W3C Logging Fields dialog box, click Add Field. In the Add Custom Field dialog box, configure the field information, and then click OK.

   • Field Name: Enter X-Forwarded-For.

   • Source Type: Keep the default value, Request Header.

   • Source: Enter X-Forwarded-For.

   

4. Confirm that the custom field has been added and click OK.

   

5. In the Actions pane on the right, click Apply to save the changes.

   

Nginx server

The default path for the Nginx access log is /var/log/nginx/access.log.

In each log entry, the value of the $http_x_forwarded_for variable is the real client IP.

Apache server

The default path for the Apache access log is /var/log/httpd/access_log.

In each log entry, the value of the %{X-Forwarded-For}i variable is the real client IP.

IIS server

The default path for the IIS access log is %SystemDrive%\inetpub\logs\LogFiles.

In each log entry, the value in the final X-Forwarded-For field is the real client IP.