I think I have some sort of Masquerading problem. When web traffic is logged to my IIS logs, it gets logged as the internal interface ip on my Firewall instead of the outside client's ip address. Is there a way to tweak the rules so I'm getting actual client ip addresses in my IIS logs?
I'm using a Webserver Protection rule to publish the webserver. It's a standard port 80 web server. The firewall is logging external ip's, but when I try to look at the iis logs, all the traffic from outside my network looks like this:
Where 192.168.4.7 is the internal address of my webserver and 192.168.4.1 is the address of the gateway adapter on the Sophos UTM9. All traffic coming from outside my network (i.e. public traffic) is logged in my IIS logs as the address of the internal gateway on the firewall.
Is there a way to get actual ip addresses into my iis logs. The main reason I care is to parse out the logs and compare raw traffic to Google Analytics hit counts.
This is normal what you see. There is no way to see the real address because all the connection from the world are going to the UTM WAF. This is what publish do , there is no communication from the world to your internal server. So that's what you only see the UTM instead , case he is the only one communicating with your internal server.
Quote