To allow the Zyxel USG 100's NAT to forward untouched packets to my web server i edited the policy route of the Zyxel.

Zyxel -> Configuration -> Network ->Routing -> Policy Route

I just edit the "Address Translation" option from "outgoing-interface" to "none"

Now apache is logging true external clients ip addresses


Good morning mates

today i'm facing a problem to correctly log clients request onto my corporate Apache2 web server

Network scheme:

////////////    _                      WAN1
| INTERNET /  _/  ===> CISCO Router =======> first public ip ==> to corporate LAN
////////////                      || 
                                  || zyxel eth0 ip:
                                  || label: WAN2
              ZYXEL ROUTER   ___ eth0 _________________________________________________
                             |   ZYXEL                                                |
                             |   Gateway
                             |    ||                                                  |
                             |    ||                                                  |
                             |   |\/| FIREWALL (accept request from eth0/WAN2 on port |                  
                             |    ||            443/80 and forward them to LAN1)      |
                             |    ||                                                  |
                             |   |\/| NAT (forward request on to       |
                             |    ||        web server on            |
                                  *zyxel eth1 ip:, label: lan1*
                                   |                    \   mysqlserver
                           ________|                    ++
  webserver  / 

When someone (from Internet or my private lan) request a page to my public ip on port 80, my webserver respond to it correctly. But when i want to check access.log of my web server i can see only my Zyxel router ip logged.

I suppose there is a NAT problem, it seems that the Zyxel subsitutes its ip address as SRC of IP packets coming to my webserver.

What i have to do to get a properly logged web requests with public clients ip addresses? Router is the Zyxel USG 100

this is my Apache2 log configurations (apache2.log)

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

this is my vhost log configuration

CustomLog /var/log/apache2/xyz.com/access.log combined


  • Rather than putting the answer in the question it's OK to self-answer once you have an answer. – tombull89 Jan 13 '14 at 14:57
  • ok, thank you. Should i report here the solution? – Matt Jan 13 '14 at 16:08
  • Yes, please. New users might have to wait a bit before answering their own question, but it's better if you post the answer as...well, an answer. – tombull89 Jan 13 '14 at 20:52

%{X-ClientSide}i may be what you want to add to your logformat to get the remote address of the client.

  • Thank you for your 2cents but as i expected it was a Nat/Firewall or Routing problem. – Matt Jan 13 '14 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.