It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Web Application Firewall

How to Make the Client IP Address Available to the Backend Server in Proxy Mode

  • Last updated on

When deployed in proxy mode, the Barracuda Web Application Firewall appears by default as the source IP address in the requests it forwards to the backend servers. For servers on the backend needing to access the actual client IP address, the Barracuda Web Application Firewall provides two configurable ways to achieve this:

  • Client Impersonation
  • X-Forwarded-For Header

Although both of these options provide the client IP address to the servers, consider the following before deciding which option to use:

Client ImpersonationX-Forwarded-For Header

Provides the client IP address in the source IP address of the request.

Requires a networking change.

Performance impact.

Provides the client IP address in the header "X-Forwarded-For" of the request.

Requires a logging change.

 

Using the Client IP Address from the X-Forwarded-For Header

By default, the client IP address is inserted by the Barracuda Web Application Firewall in the request Header "X-Forwarded-For" when the request is forwarded to the backend server. 

To use the embedded IP address with Apache servers or with IIS 7 or IIS 7.5 servers, refer to the following articles:

Logging Client IP Address When the Barracuda Web Application Firewall is Deployed Behind a Proxy

If the Barracuda Web Application Firewall is deployed behind a proxy server, all requests have their client IP address as the address of the proxy server, which is logged as the Client IP on the BASIC > Access Logs page. To log the actual client IP address, specify the header name appended by the proxy server that contains the actual client IP address in the Header for Client IP Address field on the BASIC > Services page. 

Configure the Header Name
  1. Edit the service from the BASIC > Services page.
  2. Scroll down to the Basic Security section and specify the header name in the Header for Client IP Address field. The standard headers used to store the actual client IP address are:

If the proxy is appending a custom header, specify that header in the Header for Client IP Address field.

When a request is received, the Barracuda Web Application Firewall gets the actual client IP address from the specified header and displays it in the Client IP field of the Access Logs.

For example, consider the client IP addresses 174.15.230.2 and 174.15.230.3, and proxy IP address 174.15.230.254. When the client sends a request, the proxy receives the request and stores the IP address of the client in the X-Forwarded-For or X-Client-IP header, and forwards the request to the Barracuda Web Application Firewall. The Barracuda Web Application Firewall extracts the client IP address from the specified header and displays it in the Access Logs.

Scenario 1:

fx_forw_for.png

Scenario 2:

fx_forw_for_01.png