Set REMOTE_ADDR to X-Forwarded-For in apache

Question

In a situation where Apache is sitting behind a reverse proxy (such as Squid), the cgi environment variable REMOTE_ADDR gets the address of the proxy rather tha

Answer 1

Since Apache 2.4 there is mod_remoteip built-in module that does this.

1. Enable mod_remoteip
   (e.g. a2enmod remoteip)

2. Create a list of trusted IP ranges (the IPs from which you accept the remote IP header). You can put them in a file like conf/trusted-ranges.txt

3. Add this line to the Apache config:

   RemoteIPTrustedProxyList conf/trusted-ranges.txt
   

4. Change your log file formats to use %a instead of %h for logging the client IP.

---

For Cloudflare you need to trust all their IP ranges and use a custom header CF-Connecting-IP:

RemoteIPHeader CF-Connecting-IP

You can get Cloudflare ranges like this:

curl https://www.cloudflare.com/ips-v4 > trusted-ranges.txt
curl https://www.cloudflare.com/ips-v6 >> trusted-ranges.txt