2 <!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
3 <?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
4 <!-- $LastChangedRevision$ -->
7 Licensed to the Apache Software Foundation (ASF) under one or more
8 contributor license agreements. See the NOTICE file distributed with
9 this work for additional information regarding copyright ownership.
10 The ASF licenses this file to You under the Apache License, Version 2.0
11 (the "License"); you may not use this file except in compliance with
12 the License. You may obtain a copy of the License at
14 http://www.apache.org/licenses/LICENSE-2.0
16 Unless required by applicable law or agreed to in writing, software
17 distributed under the License is distributed on an "AS IS" BASIS,
18 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19 See the License for the specific language governing permissions and
20 limitations under the License.
23 <modulesynopsis metafile="mod_remoteip.xml.meta">
25 <name>mod_remoteip</name>
26 <description>Replaces the original client IP address for the connection
27 with the useragent IP address list presented by a proxies or a load balancer
28 via the request headers.
32 <sourcefile>mod_remoteip.c</sourcefile>
33 <identifier>remoteip_module</identifier>
36 <p>This module is used to treat the useragent which initiated the
37 request as the originating useragent as identified by httpd for the
38 purposes of authorization and logging, even where that useragent is
39 behind a load balancer, front end server, or proxy server.</p>
41 <p>The module overrides the client IP address for the connection
42 with the useragent IP address reported in the request header configured
43 with the <directive module="mod_remoteip">RemoteIPHeader</directive> directive.</p>
45 <p>Additionally, this module implements the server side of
47 <a href="http://blog.haproxy.com/haproxy/proxy-protocol/">PROXY Protocol</a> when
48 using the <directive module="mod_remoteip">RemoteIPProxyProtocol</directive>
51 <p>Once replaced as instructed, this overridden useragent IP address is
52 then used for the <module>mod_authz_host</module>
53 <directive module="mod_authz_core" name="Require">Require ip</directive>
54 feature, is reported by <module>mod_status</module>, and is recorded by
55 <module>mod_log_config</module> <code>%a</code> and <module>core</module>
56 <code>%a</code> format strings. The underlying client IP of the connection
57 is available in the <code>%{c}a</code> format string.</p>
59 <note type="warning">It is critical to only enable this behavior from
60 intermediate hosts (proxies, etc) which are trusted by this server, since
61 it is trivial for the remote useragent to impersonate another
65 <seealso><module>mod_authz_host</module></seealso>
66 <seealso><module>mod_status</module></seealso>
67 <seealso><module>mod_log_config</module></seealso>
68 <seealso><a href="http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt">Proxy Protocol Spec</a></seealso>
70 <section id="processing"><title>Remote IP Processing</title>
72 <p>Apache by default identifies the useragent with the connection's
73 client_ip value, and the connection remote_host and remote_logname are
74 derived from this value. These fields play a role in authentication,
75 authorization and logging and other purposes by other loadable
78 <p>mod_remoteip overrides the client IP of the connection with the
79 advertised useragent IP as provided by a proxy or load balancer, for
80 the duration of the request. A load balancer might establish a long
81 lived keepalive connection with the server, and each request will
82 have the correct useragent IP, even though the underlying client IP
83 address of the load balancer remains unchanged.</p>
85 <p>When multiple, comma delimited useragent IP addresses are listed in the
86 header value, they are processed in Right-to-Left order. Processing
87 halts when a given useragent IP address is not trusted to present the
88 preceding IP address. The header field is updated to this remaining
89 list of unconfirmed IP addresses, or if all IP addresses were trusted,
90 this header is removed from the request altogether.</p>
92 <p>In overriding the client IP, the module stores the list of intermediate
93 hosts in a remoteip-proxy-ip-list note, which <module>mod_log_config</module>
94 can record using the <code>%{remoteip-proxy-ip-list}n</code> format token.
95 If the administrator needs to store this as an additional header, this
96 same value can also be recording as a header using the directive
97 <directive module="mod_remoteip">RemoteIPProxiesHeader</directive>.</p>
99 <note><title>IPv4-over-IPv6 Mapped Addresses</title>
100 As with httpd in general, any IPv4-over-IPv6 mapped addresses are recorded
101 in their IPv4 representation.</note>
103 <note><title>Internal (Private) Addresses</title>
104 All internal addresses 10/8, 172.16/12, 192.168/16, 169.254/16 and 127/8
105 blocks (and IPv6 addresses outside of the public 2000::/3 block) are only
106 evaluated by mod_remoteip when <directive module="mod_remoteip">RemoteIPInternalProxy</directive>
107 internal (intranet) proxies are registered.</note>
112 <name>RemoteIPHeader</name>
113 <description>Declare the header field which should be parsed for useragent IP addresses</description>
114 <syntax>RemoteIPHeader <var>header-field</var></syntax>
115 <contextlist><context>server config</context><context>virtual host</context></contextlist>
118 <p>The <directive module="mod_remoteip">RemoteIPHeader</directive> directive triggers
119 <module>mod_remoteip</module> to treat the value of the specified
120 <var>header-field</var> header as the useragent IP address, or list
121 of intermediate useragent IP addresses, subject to further configuration
122 of the <directive module="mod_remoteip">RemoteIPInternalProxy</directive> and
123 <directive module="mod_remoteip">RemoteIPTrustedProxy</directive> directives.</p>
125 <note type="warning"> Unless these other directives are used, <module>mod_remoteip</module>
126 will trust all hosts presenting a non internal address in the
127 <directive module="mod_remoteip">RemoteIPHeader</directive> header value.
130 <example><title>Internal (Load Balancer) Example</title>
131 <highlight language="config">
132 RemoteIPHeader X-Client-IP
136 <example><title>Proxy Example</title>
137 <highlight language="config">
138 RemoteIPHeader X-Forwarded-For
145 <name>RemoteIPInternalProxy</name>
146 <description>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</description>
147 <syntax>RemoteIPInternalProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</syntax>
148 <contextlist><context>server config</context><context>virtual host</context></contextlist>
151 <p>The <directive module="mod_remoteip">RemoteIPInternalProxy</directive> directive adds one
152 or more addresses (or address blocks) to trust as presenting a valid
153 RemoteIPHeader value of the useragent IP. Unlike the
154 <directive module="mod_remoteip">RemoteIPTrustedProxy</directive> directive, any IP address
155 presented in this header, including private intranet addresses, are
156 trusted when passed from these proxies.</p>
158 <example><title>Internal (Load Balancer) Example</title>
159 <highlight language="config">
160 RemoteIPHeader X-Client-IP
161 RemoteIPInternalProxy 10.0.2.0/24
162 RemoteIPInternalProxy gateway.localdomain
169 <name>RemoteIPInternalProxyList</name>
170 <description>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</description>
171 <syntax>RemoteIPInternalProxyList <var>filename</var></syntax>
172 <contextlist><context>server config</context><context>virtual host</context></contextlist>
175 <p>The <directive module="mod_remoteip">RemoteIPInternalProxyList</directive> directive specifies
176 a file parsed at startup, and builds a list of addresses (or address blocks)
177 to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>
179 <p>The '<code>#</code>' hash character designates a comment line, otherwise
180 each whitespace or newline separated entry is processed identically to
181 the <directive module="mod_remoteip">RemoteIPInternalProxy</directive> directive.</p>
183 <example><title>Internal (Load Balancer) Example</title>
184 <highlight language="config">
185 RemoteIPHeader X-Client-IP
186 RemoteIPInternalProxyList conf/trusted-proxies.lst
190 <example><title>conf/trusted-proxies.lst contents</title>
192 # Our internally trusted proxies;
193 10.0.2.0/24 #Everyone in the testing group
194 gateway.localdomain #The front end balancer
201 <name>RemoteIPProxiesHeader</name>
202 <description>Declare the header field which will record all intermediate IP addresses</description>
203 <syntax>RemoteIPProxiesHeader <var>HeaderFieldName</var></syntax>
204 <contextlist><context>server config</context><context>virtual host</context></contextlist>
207 <p>The <directive module="mod_remoteip">RemoteIPProxiesHeader</directive> directive specifies
208 a header into which <module>mod_remoteip</module> will collect a list of
209 all of the intermediate client IP addresses trusted to resolve the useragent
210 IP of the request. Note that intermediate
211 <directive module="mod_remoteip">RemoteIPTrustedProxy</directive> addresses are recorded in
212 this header, while any intermediate
213 <directive module="mod_remoteip">RemoteIPInternalProxy</directive> addresses are discarded.</p>
215 <example><title>Example</title>
216 <highlight language="config">
217 RemoteIPHeader X-Forwarded-For
218 RemoteIPProxiesHeader X-Forwarded-By
225 <name>RemoteIPProxyProtocol</name>
226 <description>Enable, optionally enable or disable the PROXY protocol handling</description>
227 <syntax>RemoteIPProxyProtocol On|Optional|Off</syntax>
228 <contextlist><context>server config</context><context>virtual host</context>
232 <p>The <directive>RemoteIPProxyProtocol</directive> enables or
233 disables the reading and handling of the PROXY protocol connection header.
234 If enabled with the <code>On</code> flag, the upstream client <em>must</em>
235 send the header every time it opens a connection or the connection will
236 be aborted. If enabled with the <code>Optional</code> flag, the upstream
237 client <em>may</em> send the header.</p>
239 <p>While this directive may be specified in any virtual host, it is
240 important to understand that because the PROXY protocol is connection
241 based and protocol agnostic, the enabling and disabling is actually based
242 on ip-address and port. This means that if you have multiple name-based
243 virtual hosts for the same host and port, and you enable it any one of
244 them, then it is enabled for all them (with that host and port). It also
245 means that if you attempt to enable the PROXY protocol in one and disable
246 in the other, that won't work; in such a case the last one wins and a
247 notice will be logged indicating which setting was being overridden.</p>
249 <note type="hint">When multiple virtual hosts on the same IP and port are
250 configured with a combination of <code>On</code> and <code>Optional</code>
251 flags, connections will not be aborted if the header is not sent.
252 Instead, enforcement will happen after the request is read so virtual
253 hosts configured with <code>On</code> will return a 400 Bad Request.
254 Virtual hosts configured with <code>Optional</code> will continue as
255 usual but without replacing the client IP information</note>
257 <highlight language="config">
259 <VirtualHost *:80>
260 ServerName www.example.com
261 RemoteIPProxyProtocol Optional
263 #Requests to this virtual host may optionally not have
264 # a PROXY protocol header provided
267 <VirtualHost *:80>
268 ServerName www.example.com
269 RemoteIPProxyProtocol On
271 #Requests to this virtual host must have a PROXY protocol
272 # header provided. If it is missing, a 400 will result
276 <VirtualHost *:8080>
277 ServerName www.example.com
278 RemoteIPProxyProtocol On
280 #Requests to this virtual host must have a PROXY protocol
281 # header provided. If it is missing, the connection will
289 <name>RemoteIPTrustedProxy</name>
290 <description>Restrict client IP addresses trusted to present the RemoteIPHeader value</description>
291 <syntax>RemoteIPTrustedProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</syntax>
292 <contextlist><context>server config</context><context>virtual host</context></contextlist>
295 <p>The <directive module="mod_remoteip">RemoteIPTrustedProxy</directive>
296 directive restricts which peer IP addresses (or address blocks) will be
297 trusted to present a valid RemoteIPHeader value of the useragent IP.</p>
299 <p> Unlike the <directive module="mod_remoteip">RemoteIPInternalProxy</directive> directive, any intranet
300 or private IP address reported by such proxies, including the 10/8, 172.16/12,
301 192.168/16, 169.254/16 and 127/8 blocks (or outside of the IPv6 public
302 2000::/3 block) are not trusted as the useragent IP, and are left in the
303 <directive module="mod_remoteip">RemoteIPHeader</directive> header's value.</p>
305 <note type="warning">By default, <module>mod_remoteip</module> will trust
306 all hosts presenting a non internal address in the
307 <directive module="mod_remoteip">RemoteIPHeader</directive> header value.
310 <example><title>Trusted (Load Balancer) Example</title>
311 <highlight language="config">
312 RemoteIPHeader X-Forwarded-For
313 RemoteIPTrustedProxy 10.0.2.16/28
314 RemoteIPTrustedProxy proxy.example.com
321 <name>RemoteIPTrustedProxyList</name>
322 <description>Restrict client IP addresses trusted to present the RemoteIPHeader value</description>
323 <syntax>RemoteIPTrustedProxyList <var>filename</var></syntax>
324 <contextlist><context>server config</context><context>virtual host</context></contextlist>
327 <p>The <directive module="mod_remoteip">RemoteIPTrustedProxyList</directive> directive specifies
328 a file parsed at startup, and builds a list of addresses (or address blocks)
329 to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>
331 <p>The '<code>#</code>' hash character designates a comment line, otherwise
332 each whitespace or newline separated entry is processed identically to
333 the <directive module="mod_remoteip">RemoteIPTrustedProxy</directive> directive.</p>
335 <example><title>Trusted (Load Balancer) Example</title>
336 <highlight language="config">
337 RemoteIPHeader X-Forwarded-For
338 RemoteIPTrustedProxyList conf/trusted-proxies.lst
342 <example><title>conf/trusted-proxies.lst contents</title>
343 # Identified external proxies;<br/>
344 192.0.2.16/28 #wap phone group of proxies<br/>
345 proxy.isp.example.com #some well known ISP