Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

SOLVED

To allow the Zyxel USG 100's NAT to forward untouched packets to my web server i edited the policy route of the Zyxel.

Zyxel -> Configuration -> Network ->Routing -> Policy Route

I just edit the "Address Translation" option from "outgoing-interface" to "none"

Now apache is logging true external clients ip addresses


SOLVED

Good morning mates

today i'm facing a problem to correctly log clients request onto my corporate Apache2 web server

Network scheme:

////////////    _                      WAN1   11.11.11.12
| INTERNET /  _/  ===> CISCO Router =======> first public ip ==> to corporate LAN
////////////                      || 
                                  || 
                                  || 
                                  || zyxel eth0 ip: 11.11.11.11
                                  || label: WAN2
                                  \/
              ZYXEL ROUTER   ___ eth0 _________________________________________________
                             |   ZYXEL                                                |
                             |   Gateway
                             |    ||                                                  |
                             |    ||                                                  |
                             |   |\/| FIREWALL (accept request from eth0/WAN2 on port |                  
                             |    ||            443/80 and forward them to LAN1)      |
                             |    ||                                                  |
                             |   |\/| NAT (forward request on 11.11.11.11:80 to       |
                             |    ||        web server on 192.168.1.10:80)            |
                             |____||__________________________________________________|
                                  *zyxel eth1 ip: 192.168.1.1, label: lan1*
                                  ||
                                  \|____________________
                                   |                    \   mysqlserver 192.168.1.20
                           ________|                    ++
  webserver 192.168.1.10  / 
                         ++

When someone (from Internet or my private lan) request a page to my public ip 11.11.11.11 on port 80, my webserver respond to it correctly. But when i want to check access.log of my web server i can see only my Zyxel router ip 192.168.1.1 logged.

I suppose there is a NAT problem, it seems that the Zyxel subsitutes its ip address as SRC of IP packets coming to my webserver.

What i have to do to get a properly logged web requests with public clients ip addresses? Router is the Zyxel USG 100

this is my Apache2 log configurations (apache2.log)

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

this is my vhost log configuration

CustomLog /var/log/apache2/xyz.com/access.log combined

Thanks

share|improve this question
    
Rather than putting the answer in the question it's OK to self-answer once you have an answer. –  tombull89 Jan 13 at 14:57
    
ok, thank you. Should i report here the solution? –  mrbang0day Jan 13 at 16:08
    
Yes, please. New users might have to wait a bit before answering their own question, but it's better if you post the answer as...well, an answer. –  tombull89 Jan 13 at 20:52

1 Answer 1

%{X-ClientSide}i may be what you want to add to your logformat to get the remote address of the client.

share|improve this answer
    
Thank you for your 2cents but as i expected it was a Nat/Firewall or Routing problem. –  mrbang0day Jan 13 at 14:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.