Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just cannot seem to get the real client IP to show in PHP's $_SERVER['REMOTE_ADDR']. It shows in $_SERVER['X_FORWARDED_FOR'], but the $_SERVER['REMOTE_ADDR'] always points to the Varnish service IP.

I've played around with just about every Varnish vcl suggestion I could find. I've installed Apache module mod_rpaf. But I still cannot get $_SERVER['REMOTE_ADDR'] to reflect the client's real IP...

So my question is, is this even possible? Does everyone who uses Varnish have to do something like this for all PHP applications?:

$_SERVER['REMOTE_ADDR'] = $_SERVER['X_FORWARDED_FOR'];

Or am I simply not configuring it correctly?

share|improve this question

5 Answers 5

up vote 1 down vote accepted

mod_extract_forwarded is most supported, stable and available module for this. Included in all major distributions.

http://www.openinfo.co.uk/apache/

share|improve this answer
    
Interesting. You mention its in all major distributions, but I cannot seem to find it in my Ubuntu 12.04 repository: apt-cache search apache2-mod Doesn't show it. Does this mean I'd need to download the source and compile it for my host? –  Gavin Sep 8 '12 at 19:43
    
Another question, when I compile that module using apxs2 -iac and restart Apache I get this error: apache2: Syntax error on line 210 of /etc/apache2/apache2.conf: Syntax error on line 1 of /etc/apache2/mods-enabled/extract_forwarded.load: Cannot load /usr/lib/apache2/modules/mod_extract_forwarded.so into server: /usr/lib/apache2/modules/mod_extract_forwarded.so: undefined symbol: proxy_hook_scheme_handler Action 'configtest' failed. The Apache error log may have more information. ...fail! –  Gavin Sep 8 '12 at 20:04
    
Seems like your distro doesn't include correct headers and library combination. Search for binaries in repos. apt-cache search extract –  GioMac Sep 12 '12 at 7:56
    
Also, I've used mod_realip2 for some time, but I like mod_extract_forwarded more for reasons described before. –  GioMac Sep 12 '12 at 7:59

You should take a look at mod_rpaf which can be configured to 'fix' this for you

It changes the remote address of the client visible to other Apache modules when two conditions are satisfied...

share|improve this answer
    
I have actually been using mod_rpaf. I am getting the correct client IP in $_SERVER['X_FORWARDED_FOR'], just not in $_SERVER['REMOTE_ADDR']. Is this normal, or am I messing something up? –  Gavin Sep 8 '12 at 19:36

I personally make use of the auto_prepend_file directive in php.ini

Just create a PHP script like so:

<?php $_SERVER['REMOTE_ADDR'] = $_SERVER['X_FORWARDED_FOR'];

and then edit your php.ini to execute the script before any other script.

share|improve this answer

Regarding the error "undefined symbol: proxy_hook_scheme_handler Action 'configtest' failed. "

I ran into the same issue and t this web page, but no mention of a solution on the web. The possible solutions are inside the 'INSTALL' of the package!

If the Apache instance you are adding mod_extract_forwarded to will not have mod_proxy and proxy_http loaded then you will get an error when mod_extract_forwarded is loaded. In that case edit mod_extract_forwarded.c and comment out the #define for USING_proxy_http_module or change it to an an #undef. If you subsequently run Apache with proxy_http do not forget to reinstate the #define; failure to do so will mean that any X-Fowarded-For header inserted by proxy_http will use the spoofed IP number in error.

So basically:either enable 'mod_proxy and proxy_http' OR comment out the 'USING_proxy_http_module' define in the c file and rebuild. The latter worked for me, I apparently applied the first solution on an earlier server setup (and I forgot about it).

[Edit:] Install 'mod_proxy' with apt-get install libapache2-mod-proxy-html

share|improve this answer

As mentioned, use mod_extract_forwarded.

If you get the following error when reloading the apache configuration:

Syntax error on line 1 of /etc/httpd/conf.d/mod_extract_forwarded.conf: Cannot load /etc/httpd/modules/mod_extract_forwarded.so into server: /etc/httpd/modules/mod_extract_forwarded.so: undefined symbol: proxy_hook_scheme_handler

Just load the mod_proxy module before mod_extract_forwarded. Works fine on CentOS 6.4.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.