You can try to use mod_extract_forwarded
instead of mod_rpaf
— it supports MEFaccept all
(and if you use RHEL/CentOS/other-clone, the package is already in EPEL). One downside of mod_extract_forwarded
is that the X-Forwarded-For
and Forwarded-For
header names are hardcoded and not configurable like in mod_rpaf
.
There is no support for IP ranges even in mod_extract_forwarded
, but you may configure a firewall to allow direct access to Apache only from some IP ranges, or check the MEF_RPROXY_ADDR
environment variable in mod_rewrite
rules.
After some more thinking about this I found a problem with this mod_extract_forwarded
config — while mod_rpaf
does not support chains of multiple proxies and takes just the last address from the X-Forwarded-For
header, mod_extract_forwarded
attempts to support this and uses the last address which does not belong to the trusted proxy list (so that if the request has passed through multiple trusted proxies, the actual client address will be used instead of the second-to-last proxy address). Unfortunately, using MEFaccept all
means that mod_extract_forwarded
will trust all proxies, therefore if ELB proxies just append their data to the X-Forwarded-For
header, and not replace it completely, clients could pass any spoofed IP by sending requests with their own X-Forwarded-For
headers.
However, I have found yet another module to parse X-Forwarded-For
headers. Recent (unstable) Apache versions have the mod_remoteip module, which apparently supports subnet masks for proxy addresses. There is a backport to Apache 2.2 and a spec file for Fedora; unfortunately, the request to include package in Fedora is stalled.