Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Note, I can't use SSL termination at the load balancer, due to network security related issues.

The client IP I get is of course that of the load balancer. I know that the load balancer can't modify the HTTPS message without having my key, but is there another way to get the client IP address when load balancing with SSL, such as maybe just load balancing at the TCP level, or something?

share|improve this question
What kind of load balancer? I suspect that if you put the cert on the LB and then also passed the traffic still encrypted to the destination you might get what you want. I want to say an F5 can do that. – CrazyDart Jun 20 '13 at 16:43
@CrazyDart - thanks. It's a Rackspace "cloud load balancer". I told them that same thing "just decrypt, add headers, re-encrypt, transfer back to my server"... – orokusaki Jun 20 '13 at 18:05
up vote 1 down vote accepted

In a short answer, you have to terminate the SSL at the load balancer if you want X-Forwarded-For to work.

Otherwise in a typical configuration with a "dumb" load balancer, the load balancer only acts as an intermediary between the VIP and the real IP - resulting in the load balancer's IPs showing up in the logs. The load balancer cannot insert a header if it cannot decrypt the traffic.

As for balancing TCP connections, that is essentially what you are doing if you're not terminating SSL at the load balancer.

It's possible that a NetScaler or some manner of proxy device could be configured to log requests by IP, but without the private key it would not be able to determine the specifics of the request such as the URI or request method.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.