On Amazon Web Services, I have an EC2 instance running Apache and mod_remoteip. The instance is behind a Virtual Private Cloud (VPC) hosted Elastic Load Balancer (ELB).
In the mod_remoteip config file, I have:
which are the us-west-1a and us-west-1c subnets that the ELB can reside in.
In Amazon Route 53, for both MyDomain.com and www.MyDomain.com, I have A-IPv4 Alias records that point to the ELB (example: dualstack.my-load-balancer-1-251757805.us-west-1.elb.amazonaws.com.) There are no AAAA-IPv6 records for the Hosted Zone.
This setup works great, allowing my code easy access to the user's IP address.
However, very occasionally, mod_remoteip fills in an IPv6 address as the user's IP address. This IPv6 address causes issues in my setup, as some outside services I work with will not accept an IPv6 address. I must keep the IP address limited to IPv4.
I was under the impression that since I have no AAAA-IPv6 Alias records for my domain in the Hosted Zone, and that because ELBs in VPCs only use IPv4 addresses (http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internet-facing-load-balancers.html) that mod_remoteip should never be passing my code an IPv6 address. Clearly this is not always the case.
My question is: Using standard Amazon Web Services infrastructure, or Apache/mod_remoteip configuration, is there some way to only allow visitors to connect to the ELB using IPv4 only?