This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Forward public IP to Web Server

Hi to all and sorry for my English,

my configuration:
- UTM 9.201-23 with WAF module
- Web server IIS behind

On UTM
- Real Web Server for http with private ip of web server
- Virtual Web Server from public interface of UTM on Real WebServer

All work fine, but my question:
IIS log on web sites running on web server report as remote IP the internal interface private IP of UTM and not the real public IP ot the remote client.

In UTM log instead i find public IP of remote client.

How i can "forward" the remote public IP of client to web server?

I hope to be clear in my request.

Thanks in advanced.

Kind regards.

Massimo

This thread was automatically locked due to age.

0 solae over 10 years ago

Hi Massimo

You can use the "x-forwarded-for" header entry to get the clients IP. I've done this for mx apache Webserver.

This should help you:
http://blogs.iis.net/deanc/archive/2013/07/08/iis7-8-logging-the-real-client-ip-in-the-iis-hit-logs.aspx

Michael
Cancel
Vote Up 0 Vote Down

Cancel
0 mlsftwr over 10 years ago

Hi Solae and thanks for your reply,

i see you point, but we have different web services with different application wrote in different language. This solution allow, for instance, asp page to read real IP with Request.ServerVariables("REMOTE_ADDR")?

How, as in our old ISA server, i can change this setting at firewall level?

Thanks another time for any help.

Kind regards.

Massimo
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

This can't be changed in WebAdmin, Massimo. You might offer a Feature Suggestion.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 mlsftwr over 10 years ago

Hi BAlfson and thank sfor your reply,

this is unbelievable and is not a good news. Absolutely not.

We have a lot of web server / web application with statistical information unusable.

I have already write a feature suggestion, but we need a solution ASAP or we will be forced to go back to ISA and after move to different product.

Thanks another time.

Regards.

Massimo
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Hi,

ASP and any other language should be able to read the header.

There are also plugins for IIS to force it to log the IP in the header.

Another option is using DNATs instead of the WAF.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 mlsftwr over 10 years ago

Hi BarryG and thanks for your reply,

we have solved with this:

Client-ip not logged on application server when using ARR : Anil Ruia's Blog : The Official Microsoft IIS Site

It modify default behavior off IIS log that now report remote client IP.

I hope that this can help other forum users.

Thanks to all for received help.

Kind regards.

Massimo
Cancel
Vote Up 0 Vote Down

Cancel