Read more

Apache: Log the original client IP when your site sits behind a reverse proxy

Henning Koch
January 03, 2011Software engineer at makandra GmbH

When your site is mapped into the URL-space of another server using mod_proxy, ProxyPass and ProxyPassReverse, all requests in your Apache logs are logged with the IP address of the proxying server. The IP address of the original client doing the request is not logged, making it difficult to trace problems and run statistics.

Short answer

Illustration online protection

Rails Long Term Support

Rails LTS provides security patches for old versions of Ruby on Rails (2.3, 3.2, 4.2 and 5.2)

  • Prevents you from data breaches and liability risks
  • Upgrade at your own pace
  • Works with modern Rubies
Read more Show archive.org snapshot

There is no easy way to fix this. Use the log of the proxying server instead, which logs the original client IPs you're looking for.

Long answer

You can fix this for your access log, but not for your error log.

The proxying server adds a header X-Forwarded-For to every request. It includes the original client IP. You can include that header in your access log by using a custom log format:

# This is untested code:
LogFormat "%h (%{X-Forwarded-For}i) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_forwarded_for
CustomLog /var/www/project/log/access.log combined_with_forwarded_for

You cannot define a custom log format for your error log.

Posted by Henning Koch to makandra dev (2011-01-03 16:58)