Resolving Visitor IP Address

Question

Hi there, 
 I'm currently having some trouble with resolving the IP addresses of visitors to websites hosted on my web server. 
 I have a Server 2016 box running IIS, which I route through Sophos UTM's Web Server Protection on port 443. This is where I believe the problem lies, as I then route that traffic through the CloudFlare service. So, when somebody visits one of the websites I host, they go through CloudFlare -> Sophos UTM -> Web Server. 
 The problem I'm having is that the Web Server Protection logs are showing the source IP of visitors as IP addresses from CloudFlares IP range. I have tried making some changes with headers etc. but I just can't seem to get this to log the real IP address of the visitor. When I try to do this the other way round, e.g. display the visitors public IP address on the webpage in which they are loading, it will for some reason display the Sophos UTM's internal default gateway IP? 
 Any help with this would be greatly appreciated! 
 Regards, Richard

DouglasFoster · Accepted Answer

This is such a common situation that there is a standard for it. UTM adds the necessary header, which I believe is X-FORWARDED-FOR, but the details do not matter. 
 You just need to enable proxy mode in IIS. 
 Install IP restrictions server role feature, then open the feature, then Edit Feature Settings, and check the box for proxy mode. 
 A longer description is available from this Microsoft site. 
 https://docs.microsoft.com/en-us/iis/get-started/whats-new-in-iis-8/iis-80-dynamic-ip-address-restrictions