4

I just cannot seem to get the real client IP to show in PHP's $_SERVER['REMOTE_ADDR']. It shows in $_SERVER['X_FORWARDED_FOR'], but the $_SERVER['REMOTE_ADDR'] always points to the Varnish service IP.

I've played around with just about every Varnish vcl suggestion I could find. I've installed Apache module mod_rpaf. But I still cannot get $_SERVER['REMOTE_ADDR'] to reflect the client's real IP...

So my question is, is this even possible? Does everyone who uses Varnish have to do something like this for all PHP applications?:

$_SERVER['REMOTE_ADDR'] = $_SERVER['X_FORWARDED_FOR'];

Or am I simply not configuring it correctly?

5 Answers 5

2

mod_extract_forwarded is most supported, stable and available module for this. Included in all major distributions.

http://www.openinfo.co.uk/apache/

5
  • Interesting. You mention its in all major distributions, but I cannot seem to find it in my Ubuntu 12.04 repository: apt-cache search apache2-mod Doesn't show it. Does this mean I'd need to download the source and compile it for my host?
    – Gavin
    Sep 8, 2012 at 19:43
  • Another question, when I compile that module using apxs2 -iac and restart Apache I get this error: apache2: Syntax error on line 210 of /etc/apache2/apache2.conf: Syntax error on line 1 of /etc/apache2/mods-enabled/extract_forwarded.load: Cannot load /usr/lib/apache2/modules/mod_extract_forwarded.so into server: /usr/lib/apache2/modules/mod_extract_forwarded.so: undefined symbol: proxy_hook_scheme_handler Action 'configtest' failed. The Apache error log may have more information. ...fail!
    – Gavin
    Sep 8, 2012 at 20:04
  • Seems like your distro doesn't include correct headers and library combination. Search for binaries in repos. apt-cache search extract
    – GioMac
    Sep 12, 2012 at 7:56
  • Also, I've used mod_realip2 for some time, but I like mod_extract_forwarded more for reasons described before.
    – GioMac
    Sep 12, 2012 at 7:59
  • 1
    @Gavin or anyone else having the undefined symbol: proxy_hook_scheme_handler error, you need to enable mod_proxy too. Uncomment the line in httpd.conf LoadModule proxy_module lib64/httpd/modules/mod_proxy.so
    – Phil
    Aug 10, 2015 at 11:41
3

As mentioned, use mod_extract_forwarded.

If you get the following error when reloading the apache configuration:

Syntax error on line 1 of /etc/httpd/conf.d/mod_extract_forwarded.conf: Cannot load /etc/httpd/modules/mod_extract_forwarded.so into server: /etc/httpd/modules/mod_extract_forwarded.so: undefined symbol: proxy_hook_scheme_handler

Just load the mod_proxy module before mod_extract_forwarded. Works fine on CentOS 6.4.

2

You should take a look at mod_rpaf which can be configured to 'fix' this for you

It changes the remote address of the client visible to other Apache modules when two conditions are satisfied...

1
  • I have actually been using mod_rpaf. I am getting the correct client IP in $_SERVER['X_FORWARDED_FOR'], just not in $_SERVER['REMOTE_ADDR']. Is this normal, or am I messing something up?
    – Gavin
    Sep 8, 2012 at 19:36
0

I personally make use of the auto_prepend_file directive in php.ini

Just create a PHP script like so:

<?php $_SERVER['REMOTE_ADDR'] = $_SERVER['X_FORWARDED_FOR'];

and then edit your php.ini to execute the script before any other script.

0

Regarding the error "undefined symbol: proxy_hook_scheme_handler Action 'configtest' failed. "

I ran into the same issue and t this web page, but no mention of a solution on the web. The possible solutions are inside the 'INSTALL' of the package!

If the Apache instance you are adding mod_extract_forwarded to will not have mod_proxy and proxy_http loaded then you will get an error when mod_extract_forwarded is loaded. In that case edit mod_extract_forwarded.c and comment out the #define for USING_proxy_http_module or change it to an an #undef. If you subsequently run Apache with proxy_http do not forget to reinstate the #define; failure to do so will mean that any X-Fowarded-For header inserted by proxy_http will use the spoofed IP number in error.

So basically:either enable 'mod_proxy and proxy_http' OR comment out the 'USING_proxy_http_module' define in the c file and rebuild. The latter worked for me, I apparently applied the first solution on an earlier server setup (and I forgot about it).

[Edit:] Install 'mod_proxy' with apt-get install libapache2-mod-proxy-html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .