Apache Module mod_remoteip 2q2a6j

RemoteIPHeader Directive 6y376g

The RemoteIPHeader IP value.

RemoteIPHeader X-Client-IP

RemoteIPHeader X-Forwarded-For

RemoteIPInternalProxy Directive 2j4p6w

The RemoteIPTrustedProxy directive, any IP address presented in this header, including private intranet addresses, are trusted when ed from these proxies.

RemoteIPHeader X-Client-IP
RemoteIPInternalProxy 10.0.2.0/24
RemoteIPInternalProxy gateway.localdomain

RemoteIPInternalProxyList Directive 131a3z

The RemoteIPInternalProxyList directive specifies a file parsed at startup, and builds a list of addresses (or address blocks) to trust as presenting a valid RemoteIPHeader value of the agent IP.

The '#' hash character designates a comment line, otherwise each whitespace or newline separated entry is processed identically to the RemoteIPInternalProxy directive.

RemoteIPHeader X-Client-IP
RemoteIPInternalProxyList conf/trusted-proxies.lst

# Our internally trusted proxies;
10.0.2.0/24         #Everyone in the testing group
gateway.localdomain #The front end balancer

RemoteIPProxiesHeader Directive 6l414r

The RemoteIPInternalProxy addresses are discarded.

RemoteIPHeader X-Forwarded-For
RemoteIPProxiesHeader X-Forwarded-By

RemoteIPProxyProtocol Directive 1wm2w

The RemoteIPProxyProtocol directive enables or disables the reading and handling of the PROXY protocol connection header. If enabled with the On flag, the upstream client must send the header every time it opens a connection or the connection will be aborted unless it is in the list of disabled hosts provided by the RemoteIPProxyProtocolExceptions directive.

While this directive may be specified in any virtual host, it is important to understand that because the PROXY protocol is connection based and protocol agnostic, the enabling and disabling is actually based on IP address and port. This means that if you have multiple name-based virtual hosts for the same host and port, and you enable it for any one of them, then it is enabled for all of them (with that host and port). It also means that if you attempt to enable the PROXY protocol in one and disable in the other, that won't work; in such a case, the last one wins and a notice will be logged indicating which setting was being overridden.

Listen 80
<VirtualHost *:80>
    ServerName www.example.com
    RemoteIPProxyProtocol On

    #Requests to this virtual host must have a PROXY protocol
    # header provided. If it is missing, the connection will
    # be aborted
</VirtualHost>

Listen 8080
<VirtualHost *:8080>
    ServerName www.example.com
    RemoteIPProxyProtocol On
    RemoteIPProxyProtocolExceptions 127.0.0.1 10.0.0.0/8

    #Requests to this virtual host must have a PROXY protocol
    # header provided. If it is missing, the connection will
    # be aborted except when coming from localhost or the
    # 10.x.x.x RFC1918 range
</VirtualHost>

RemoteIPProxyProtocolExceptions Directive k3419

The RemoteIPProxyProtocol directive enables or disables the reading and handling of the PROXY protocol connection header. Sometimes it is desirable to require clients to provide the PROXY header, but permit other clients to connect without it. This directive allows a server to configure a single host or CIDR range of hosts that may do so. This is generally useful for monitoring and istrative traffic to a virtual host direct to the server behind the upstream load balancer.

RemoteIPTrustedProxy Directive 1i164

The RemoteIPHeader header's value.

RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 10.0.2.16/28
RemoteIPTrustedProxy proxy.example.com

RemoteIPTrustedProxyList Directive 2pu3c

The RemoteIPTrustedProxyList directive specifies a file parsed at startup, and builds a list of addresses (or address blocks) to trust as presenting a valid RemoteIPHeader value of the agent IP.

The '#' hash character designates a comment line, otherwise each whitespace or newline separated entry is processed identically to the RemoteIPTrustedProxy directive.

RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxyList conf/trusted-proxies.lst