All Barracuda Web Application Firewalls, 7.6 firmware and above
If the Barracuda Web Application Firewall is deployed behind a Proxy server all requests have their client IP address as the address of the Proxy server which is logged as the Client IP on the Basic > Access Logs page. To log the actual client IP address, we need to specify the header name appended by the Proxy server which contains the actual client IP address in the 'Header for Client IP Address' field in the Basic > Services page.
Steps To Configure the Header Name:
Edit the Service from the Basic > Services page.
Scroll down to the Basic Security section and specify the header name in the 'Header for Client IP Address' field. The standard headers used to store the actual client IP address are:
Specify values for other fields as required and click Save Changes.
Note: If the Proxy is appending a custom header then specify that header in the 'Header for Client IP Address' field.
When a request is received the Barracuda Web Application Firewall gets the actual client IP address from the specified header and displays it in the Client IP field of the Access Logs.
If the client IP addresses are 220.127.116.11 and 18.104.22.168 and the proxy IP address is 22.214.171.124. When the client sends a request the proxy receives the request and stores the IP address of the client in the X-Forwarded-For or X-Client-IP header and forwards the request to the Barracuda Web Application Firewall.
The Barracuda Web Application Firewall extracts the client IP address from the specified header and displays it in the Access Logs.
Link to This Page: