I am currently logging the contents of the X-Forwarded-For header using a CustomLog declaration in Apache. The problem is that every proxy and load balancer along the request path will add its IP to this header, too. I need a way to intelligently pick out the true client IP from this header and log it with CustomLog.
Here's an example:
Let's say Joe User is browsing your site from his home and has a public IP of 18.104.22.168. Let's say that your site uses Akamai as a CDN with IP 22.214.171.124 and your origin servers are all load balanced behind a load balancer that has an IP of 126.96.36.199. If you log X-Forwarded-For to your logs, you'll end up with something like this:
X-Forwarded-For: 188.8.131.52, 184.108.40.206, 220.127.116.11
The first IP (18.104.22.168) is usually what you're interested in but I'm not sure how to extract it within the CustomLog format.
It gets even more difficult when a corporate proxy server is involved. You might end up with something like this:
192.168.12.4, 22.214.171.124, 126.96.36.199, 188.8.131.52
In this case, 184.108.40.206 is what you really want to log because 192.168.12.4 is just some private IP on some corporate LAN and tells you nothing about the true location of this visitor.
How can I extract this IP and log it with the rest of the stuff?
The only approach I can think of right now is to pipe all of this through a custom filter program that extracts the first IP (unless it's in a private subnet) and logs that.