Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule:

SecAction "phase:1,nolog,pass,initcol:IP=%{REQUEST_HEADERS.x-forwarded-for}"
SecAction "nolog,phase:1,setvar:IP.hitcount=+1,deprecatevar:IP.hitcount=100/15"
SecRule IP:hitcount "@gt 600" "nolog,drop,phase:1,msg:'Possible DoS'"

No matter what I set the key to after the IP= i get the load balancer IP through which will obviously ban everybody. Is this a bug or am I donig something wrong? I even hard coded the key to and it STILL set the load balancer IP in the ip.pag file. HELP! :]

share|improve this question

I found the problem. I was putting this rule in the local rules file which is the last thing to be set. The IP collection had already been initialised by another rule which took precedence.

The solution was to move the top line (the one with initcol in) to the top of the mod_security config so that all references to the IP collection use the x-forwarded-for key that I have set rather than the default REMOTE_ADDR.

I hope this saves someone else out there a morning of pulling their hair out! :]

share|improve this answer

I also researched the problem with mod_security behind a proxy/load balancer. You could try mod_rpaf or mod_extract_forwarded2 so you don't have to adjust your rules.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.