Apache and X-Forwarded-For Header (XFF)

 It's easier to get Apache to log client IP addresses utilizing X-Forwarded-For Headers than it is using IIS. By default, the logs do not record source IP addresses for clients - but as of Apache version 2.4 you can use the ErrorLogFormat directive in the httpd.conf file as explained below.

->Did you want to learn about XFF on IIS?

There’s been a lot of debate here in the office about how best to capture both your Loadbalancer’s IP and the Source IP of the user in your access_log in Apache 2.4. This is the tried and tested method we've come up with.

How to log X-Forwarded For Headers using Apache 2.4

CentOS 7

When you start out, your httpd.conf will look something like this:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common

CustomLog "logs/access_log" combined

Now the %h is already there to capture your header, which, by default, will capture the IP of the Loadbalancer (the last proxy server that the traffic came from). All of these entries need to commented out.

Free consultancy
from the load balancer experts

talk now

Assuming you have X-Forwarded-For enabled in the load balancer (or whatever proxy server you're using), you can capture the source IP from the original client. You'll need to change your config file entries to look like this:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
CustomLog "logs/access_log" combined env=!forwarded
CustomLog "logs/access_log" proxy env=forwarded

After making this change, restart the httpd service:

systemctl restart httpd

If you review the logs on the web server now, you'll see the client source address, which has been passed through using the X-Forward-For Header:

192.168.88.10 - - [19/Oct/2017:17:16:59 +0100] "GET /homepage.php HTTP/1.1" 200 1400 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36"

Debian/Ubuntu

Directives should be added to the specific site configuration file, /etc/apache2/sites-available/000-default.conf.

You will also need to enable the following modules:

a2enmod remoteip && a2enmod headers

Next, add the logging directives into the site specific configuration file:

SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" forwarded
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined env=!forwarded
CustomLog ${APACHE_LOG_DIR}/access.log forwarded env=forwarded

After making these changes, restart the apache2 service:

systemctl restart apache2