Re: Logging real ip behind proxy

I'm also using Cloudflare for all my sites, but I have this extension
enabled in Apache (on Linux): https://github.com/cloudflare/mod_cloudflare
So my apps and all mods (including modsec) see the real IP as it should be.

I don't know how the things work in Windows, but maybe you can fix it at
app level like they suggest here:
https://support.cloudflare.com/hc/en-us/articles/200170666-How-do-I-correct-visitor-IP-with-Microsoft-IIS-

El mié., 2 de ene. de 2019 a la(s) 15:32, Eero Volotinen (
[email protected]) escribió:

> Hi.
>
> Take look of REQUEST-901-INITIALIZATION.con
>
> I think this line takes care of ip address pickup:
>
> SecAction \
>
>   "id:901321, \
>
>   phase:1, \
>
>   t:none, \
>
>   initcol:global=global, \
>
>   initcol:ip=%{remote_addr}_%{tx.ua_hash}, \
>
>   setvar:tx.real_ip=%{remote_addr}, \
>
>   nolog, \
>
> You need to replace it with correct variable?
>
> Eero
>
> On Wed, Jan 2, 2019 at 7:30 PM Alexandros Kyrlis <[email protected]>
> wrote:
>
>> I have already replaced the REMOTE_ADDR var with {HTTP_CF_Connecting_IP}
>> using IIS rewrite.
>> It works.
>>
>> using PHP:
>>
>> echo ($_SERVER['REMOTE_ADDR']);
>>
>> Returns the real client IP address.
>>
>> But mod_security still uses the ip of the proxy. I do not know why.
>>
>>
>> On 2 Ιαν 2019, at 19:03, Eero Volotinen <[email protected]> wrote:
>>
>> how about this:
>> http://www.loadbalancer.org/blog/iis-and-x-forwarded-for-header/
>>
>> Eero
>>
>> Alexandros Kyrlis via mod-security-users <
>> [email protected]> kirjoitti ke 2. tammik. 2019
>> klo 19.00:
>>
>>> Hello,
>>> I'm using Mod Security with IIS 10.
>>> When a rule is triggered, mod security creates an event log on event
>>> viewer on Windows.
>>> This log contais the REMOTE_ADDR value, but since we are behind a proxy
>>> (Cloudflare) i would like it to log a custom header (CF_Connecting_IP) so
>>> we get the real client IP.
>>> Is it possible to do that?
>>> Thanks
>>> Alex
>>>
>>>
>>>
>>> _______________________________________________
>>> mod-security-users mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>>
>> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/