mod_extforward: Lighttpd Log Clients Real IP Behind Reverse Proxy / Load Balancer

by

When you use a reverse proxy or load balancer with Lighttpd, the IP address of the client may be hidden or obscured in the server logs. To log the real IP address of the client, you can use the mod_extforward module in Lighttpd.

Here’s how to configure mod_extforward to log the real IP address of the client:

  1. Install the mod_extforward module. On Debian or Ubuntu, you can use the following command:
    sudo apt-get install lighttpd-mod-extforward
  2. Configure mod_extforward by adding the following lines to your Lighttpd configuration file (/etc/lighttpd/lighttpd.conf by default):
    server.modules += ( "mod_extforward" )
    extforward.forwarder = ( "192.168.1.1" )
    extforward.headers = ( "X-Forwarded-For" )

    Replace 192.168.1.1 with the IP address of your reverse proxy or load balancer. The extforward.headers option specifies which header to use for the real client IP address. In this example, we’re using the X-Forwarded-For header.

  3. Configure your web application to use the X-Forwarded-For header. This step will vary depending on the application. Check the documentation for your application to find out how to enable support for the X-Forwarded-For header.

    In PHP, you can access the X-Forwarded-For header using the $_SERVER superglobal array:

    $client_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
  4. Restart the Lighttpd server:
    sudo service lighttpd restart

    This will apply the changes you made to the Lighttpd configuration file.

With mod_extforward configured, the real IP address of the client will be logged in the server logs. You can test this by checking the logs and verifying that the IP address matches the client’s actual IP address.

Leave a Comment