Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a aws load balancer. The load balancer uses the TCP connections 443 to encrypt the data.

Since the load balancer encrypts the IP of the client, in our apache log file we can see only the IP of the load balancer rather then the client. Even though we have used %{X-Forwarded-For}i in our log format.

Is there any way to handle this issue?

share|improve this question
Are you doing SSL offloading in your loadbalancer? – Ladadadada Oct 17 '12 at 6:34
@Ladadadada: Yes. – sriram Oct 17 '12 at 6:39
@Ladadadada: Are there any way to say the load balancer to decrypt the info so everything is working fine?? – sriram Oct 17 '12 at 7:47
up vote 3 down vote accepted

Yes, ELBs support decrypting the SSL request and sending a plain http request back to your Apache back end servers.

The ELB will add both X-Forwarded-For and X-Forwarded-Proto headers so you can tell the difference between SSL requests and plain http requests. The non-SSL requests may only have the X-Forwarded-For header or may have the X-Forwarded-Proto header set to http.

If your Apache is receiving requests on port 443, the ELB can't be injecting any headers and your logs will only ever contain the IP address of the load balancer itself. You have to do SSL termination in the ELB to get the X-Forwarded-For header.

There's a decent tutorial here. There's also an answer specifically for Thawte here.

share|improve this answer
So you meant to say if I add X-Forwarded-Proto in my log format it will work? Or move the ssl certificates to the load balancer? – sriram Oct 17 '12 at 10:21
X-Forwarded-Proto is so your application can generate image and css links that start with https://. Moving the SSL certificates to the load balancer will allow it to add the X-Forwarded-For header which will allow your existing rules to work. Bear in mind that X-Forwarded-For can be a comma-separated list and not always a single IP address. mod_rpaf or mod_remoteip will put the correct IP address in the normal IP address variable. – Ladadadada Oct 17 '12 at 11:08

you need mod_rpaf for Apache. It will put X-FORWARDED-FOR packed IP in place of IP of Load balancers .

share|improve this answer
Does mod_rpaf tackles the problem of tcp connection port 443? Since our load balancer uses that as a port. – sriram Oct 17 '12 at 5:43
yes; port is irrelevant here; at some point SSL connection must be terminated; at that point mod_rpaf shoud kick in and use address from X-FORWARDED-FOR header – Hrvoje Špoljar Oct 17 '12 at 5:44
But why doesn't the normal %{X-Forwarded-For}i doesn't work? – sriram Oct 17 '12 at 5:47
Probably because load balancers use some other header name which is not 'X-Forwarded-For' – Hrvoje Špoljar Oct 17 '12 at 6:14
mod_rpaf will be tricky to configure behind an Amazon ELB. The problem is that you can't use CIDR notation and have to list all 16 million possible 10.x.x.x IP addresses individually. There are two solutions in the answers to that question, one of which I wrote. – Ladadadada Oct 17 '12 at 9:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.