Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Note, I can't use SSL termination at the load balancer, due to network security related issues.

The client IP I get is of course that of the load balancer. I know that the load balancer can't modify the HTTPS message without having my key, but is there another way to get the client IP address when load balancing with SSL, such as maybe just load balancing at the TCP level, or something?

share|improve this question
1  
What kind of load balancer? I suspect that if you put the cert on the LB and then also passed the traffic still encrypted to the destination you might get what you want. I want to say an F5 can do that. –  CrazyDart Jun 20 '13 at 16:43
    
@CrazyDart - thanks. It's a Rackspace "cloud load balancer". I told them that same thing "just decrypt, add headers, re-encrypt, transfer back to my server"... –  orokusaki Jun 20 '13 at 18:05
add comment

1 Answer

up vote 1 down vote accepted

In a short answer, you have to terminate the SSL at the load balancer if you want X-Forwarded-For to work.

Otherwise in a typical configuration with a "dumb" load balancer, the load balancer only acts as an intermediary between the VIP and the real IP - resulting in the load balancer's IPs showing up in the logs. The load balancer cannot insert a header if it cannot decrypt the traffic.

As for balancing TCP connections, that is essentially what you are doing if you're not terminating SSL at the load balancer.

It's possible that a NetScaler or some manner of proxy device could be configured to log requests by IP, but without the private key it would not be able to determine the specifics of the request such as the URI or request method.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.