Show Posts
931
20.7 Legacy Series / Re: Configure lighttpd to log real client IP behind reverse proxy?
« on: January 13, 2021, 01:46:32 pm »
Yup, that worked.
Guided by the lighttpd docs (https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_ModExtForward), I included the mod_extforward module in the server.modules list, and added extforward.headers and extforward.forwarder directives.
Extract from webgui.inc from line 236:
Note that I added the mod_extfoward module at the end of the server.modules list so that, if mod_accesslog is enabled through the $lighty_modules variable (reflecting that access logging is turned on in the web GUI), the mod_extforward module will be enabled afterwards, as stipulated in the lighttpd docs.
I also had to add the extforward.headers directive, because I found that the default (which is to search the "X-Forwarded-For" and "Forwarded-For" headers when the directive is empty) wasn't returning the real client IP despite X-Forwarded-For being set in my nginx config to $proxy_add_x_forwarded_for. So I added X-Real-IP, which is also set in my nginx config, and that worked. I will have to figure out separately the X-Forwarded-For issue with nginx.
Regarding the extforward.forwarder directive, that would obviously be the data item for the GUI, ie the user would be asked to enter the IP(s) of the reverse proxy. I guess the GUI could have both that, and an option to select to load the mod_extforward module (like for the mod_accesslog module), or alternatively the mod_extforward module could just be enabled by default and the only item in the GUI would be the ability to enter the IPs if the user is using a reverse proxy. I assume that the mod_extforward module, even if enabled, would just do nothing if there are no trusted IPs set in extforward.forwarder.
Guided by the lighttpd docs (https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_ModExtForward), I included the mod_extforward module in the server.modules list, and added extforward.headers and extforward.forwarder directives.
Extract from webgui.inc from line 236:
Code: [Select]
## modules to load
server.modules = (
"mod_access", "mod_expire", "mod_compress", "mod_redirect", "mod_setenv",
"mod_cgi", "mod_fastcgi","mod_alias", "mod_rewrite", "mod_openssl" {$lighty_modules}, "mod_extforward"
)
extforward.headers = ( "X-Forwarded-For”, “Forwarded-For”, "X-Real-IP” )
extforward.forwarder = (
"172.16.66.5" => "trust",
"fdfd:2553:8868:66:216:3eff:feeb:8e62" => "trust"
) Note that I added the mod_extfoward module at the end of the server.modules list so that, if mod_accesslog is enabled through the $lighty_modules variable (reflecting that access logging is turned on in the web GUI), the mod_extforward module will be enabled afterwards, as stipulated in the lighttpd docs.
I also had to add the extforward.headers directive, because I found that the default (which is to search the "X-Forwarded-For" and "Forwarded-For" headers when the directive is empty) wasn't returning the real client IP despite X-Forwarded-For being set in my nginx config to $proxy_add_x_forwarded_for. So I added X-Real-IP, which is also set in my nginx config, and that worked. I will have to figure out separately the X-Forwarded-For issue with nginx.
Regarding the extforward.forwarder directive, that would obviously be the data item for the GUI, ie the user would be asked to enter the IP(s) of the reverse proxy. I guess the GUI could have both that, and an option to select to load the mod_extforward module (like for the mod_accesslog module), or alternatively the mod_extforward module could just be enabled by default and the only item in the GUI would be the ability to enter the IPs if the user is using a reverse proxy. I assume that the mod_extforward module, even if enabled, would just do nothing if there are no trusted IPs set in extforward.forwarder.