Server Load Balancer:Retrieve real client IP addresses through ALB

Nginx

Environment: Alibaba Cloud Linux 3.2104, nginx/1.20.1. Commands and paths may vary in your environment.

Nginx uses the http_realip_module module to extract the client's real IP from the X-Forwarded-For header.

1. Verify that the module is installed.

   nginx -V 2>&1 | grep --color=auto http_realip_module

   If the output contains --with-http_realip_module, the module is installed.

   

   Nginx installed via yum or apt on mainstream Linux distributions includes this module by default. If not found, install or upgrade Nginx through your package manager.

2. Edit the Nginx configuration file.

   Run sudo nginx -t to locate the configuration file. The default path is /etc/nginx/nginx.conf. Add the following directives inside the http block:

   http {
       # Trusted proxy IP range (ALB internal IP range)
       set_real_ip_from 100.64.0.0/10;
       # For upgraded ALB instances, use the vSwitch CIDR block instead:
       # set_real_ip_from 10.0.0.0/8;
   
       # Extract real client IP from X-Forwarded-For
       real_ip_header X-Forwarded-For;
       # Use the leftmost non-trusted IP
       real_ip_recursive on;
   
       # Log format with X-Forwarded-For
       log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
   
       access_log /var/log/nginx/access.log main;
   
       # ...
   }

3. Reload the configuration.

   sudo nginx -t
   sudo nginx -s reload

Apache

Environment: Alibaba Cloud Linux 3.2104, Apache/2.4.37. Commands and paths may vary in your environment.

Apache uses the mod_remoteip module to extract the client's real IP from the X-Forwarded-For header.

1. Verify that the module is installed.

   httpd -M | grep remoteip_module

   If the output contains remoteip_module (shared), the module is installed.

   

   Apache installed via yum or apt on mainstream Linux distributions includes this module by default. If not found, install or upgrade Apache through your package manager.

2. Edit the Apache configuration file.

   Run httpd -V to locate the configuration file. The default path is /etc/httpd/conf/httpd.conf. Add the following directives:

   # Extract real client IP from X-Forwarded-For
   RemoteIPHeader X-Forwarded-For
   # Trusted proxy IP range (ALB internal IP range)
   RemoteIPInternalProxy 100.64.0.0/10
   # For upgraded ALB instances, use the vSwitch CIDR block instead:
   # RemoteIPInternalProxy 10.0.0.0/8
   
   <IfModule log_config_module>
       # Log format with X-Forwarded-For
       LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{X-Forwarded-For}i" combined
       CustomLog "logs/access_log" combined
   </IfModule>

3. Reload the configuration.

   sudo systemctl restart httpd

IIS

Environment: Windows Server 2022 21H2, IIS 10.0. Steps may vary in your environment.

IIS logs the X-Forwarded-For header value as a custom field. It does not natively replace the client IP in the request pipeline.

1. Add a custom log field.

   In IIS Manager, select the target server in the Connections pane. Double-click the Logging feature in the main panel.

   

2. Configure the field.

   Click Select Fields > Add Field and enter the following values:

   Setting	Value
   Field Name	X-Forwarded-For
   Source Type	Request Header
   Source	X-Forwarded-For

   

3. Apply the configuration.

   Click OK to confirm, then click Apply in the Actions pane.

   

To use the real client IP in your application logic, parse the X-Forwarded-For header in your application code.