sophos reverse proxy public ip address

you can try to use the informations from http-header or use the server-protection logfile from UTM.

i activate syslog at UTM and send all logs to splunk(light - free).

you can try to use the informations from http-header or use the server-protection logfile from UTM.

i activate syslog at UTM and send all logs to splunk(light - free).

Ok, i would of thought there is a setting to pass the public ip address from client to server?

No, that's the whole function of a reverse-proxy.  As mentioned, you need to look in the server logs for the http x-forwarded-for header to get the real client IP.