Website Protection: Real Visitor IP Addresses

When a site works behind protection, requests reach your server from the scrubbing servers’ addresses. Without extra configuration, these are the addresses you will see in your logs and CMS instead of your visitors’ ones.

To see real IP addresses, configure X-Forwarded-For decoding for the networks from the list you used when configuring the firewall. Below are examples for popular web servers.

Apache web server before version 2.4

Open /etc/apache2/mods-enabled/rpaf.conf and add the following lines:

<IfModule rpaf_module>
  RPAFenable On
  # When enabled, take the incoming X-Host header
  # and update the virtualhost settings accordingly:
  RPAFsethostname On
  # Define which IP's are your frontend proxies that sends
  # the correct X-Forwarded-For headers:
  RPAFproxy_ips 77.220.207.0/24 45.10.240.0/24 45.10.241.0/24 45.10.242.0/24 186.2.160.0/24 186.2.164.0/24 186.2.167.0/24 186.2.168.0/24
  # Change the header name to parse from the default
  # X-Forwarded-For to something of your choice:
  # RPAFheader DDG-Connecting-IP
</IfModule>

Then restart Apache: systemctl restart apache2.

Apache web server version 2.4 and later

1. Disable mod_rpaf with a2dismod rpaf.
2. Enable mod_remoteip with a2enmod remoteip.
3. Create or open /etc/apache2/conf-available/remoteip.conf and add the following lines:

<IfModule remoteip_module>
  # Take the incoming X-Host header and
  # update the virtualhost settings accordingly:
  RemoteIPHeader X-Forwarded-For
  # Define which IP's are your frontend proxies that sends
  # the correct X-Forwarded-For headers:
  RemoteIPTrustedProxy 77.220.207.0/24 45.10.240.0/24 45.10.241.0/24 45.10.242.0/24 186.2.160.0/24 186.2.164.0/24 186.2.167.0/24 186.2.168.0/24
</IfModule>

4. Enable the configuration with a2enconf remoteip.
5. Restart Apache: systemctl restart apache2.

Nginx web server

Add the following lines to the http section of /etc/nginx/nginx.conf:

set_real_ip_from 77.220.207.0/24;
set_real_ip_from 45.10.240.0/24;
set_real_ip_from 45.10.241.0/24;
set_real_ip_from 45.10.242.0/24;
set_real_ip_from 186.2.160.0/24;
set_real_ip_from 186.2.164.0/24;
set_real_ip_from 186.2.167.0/24;
set_real_ip_from 186.2.168.0/24;
real_ip_header X-Forwarded-For;

Check the configuration and reload Nginx: nginx -t && systemctl reload nginx.

The contents of X-Forwarded-For can be forged, but the last address in the chain is always the real IP from which the request entered the protection network. The same address is also passed in the DDG-Connecting-IP header.

The X-Real-IP header is proxied unchanged and may contain false information. Do not use it for security-related functions.