mod_remoteip.html.en revision 27dcd8d81085fd60aadcd8a9bad35a607b26b758
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin This file is generated from xml source: DO NOT EDIT
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<link href="/style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<link href="/style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen<link href="/style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen<link href="/images/favicon.ico" rel="shortcut icon" /></head>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="/faq/">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p>
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen<div class="up"><a href="./"><img title="<-" alt="<-" src="/images/left.gif" /></a></div>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.3</a> > <a href="./">Modules</a></div>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<div id="preamble"><h1>Apache Module mod_remoteip</h1>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<p><span>Available Languages: </span><a href="/en/mod/mod_remoteip.html" title="English"> en </a></p>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Replaces the apparent client remote IP address and hostname
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjungfor the request with the IP address list presented by a proxies or a load
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrinbalancer via the request headers.
7f0952c0239ea2d6e37b472db6fde4ef2718343dsf<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<tr><th><a href="module-dict.html#ModuleIdentifier">Module�Identifier:</a></th><td>remoteip_module</td></tr>
46f74e65e6051e6e9391c8e17c5116317210facetakashi<tr><th><a href="module-dict.html#SourceFile">Source�File:</a></th><td>mod_remoteip.c</td></tr></table>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <p>This module is used to treat the remote host which initiated the
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin request as the originating remote host as identified by httpd for the
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin purposes of authorization and logging, even where that remote host is
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin behind a load balancer, front end server, or proxy server.</p>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <p>The module replaces the apparent remote (client) IP/hostname for
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin the request with the IP address reported in the request header
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin configured with the <code class="directive">RemoteIPHeader</code> directive.</p>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <p>Once replaced as instructed, this apparent IP address is then used
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin for <code class="module"><a href="/mod/mod_authz_host.html">mod_authz_host</a></code> features
72c3c99143571371be76ed3916b19bd3214b4363martin <code class="directive"><a href="/mod/mod_authz_host.html#require host"><Require host></a></code>
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf and <code class="directive"><a href="/mod/mod_authz_host.html#require ip"><Require ip></a></code>,
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin is reported by <code class="module"><a href="/mod/mod_status.html">mod_status</a></code>, and is recorded by
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <code class="module"><a href="/mod/mod_log_config.html">mod_log_config</a></code> <code>%a</code> and <code>%h</code>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin directives. It also determines the machine probed for an inetd
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf identity by <code class="module"><a href="/mod/mod_ident.html">mod_ident</a></code> based on the
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <code class="directive"><a href="/mod/mod_ident.html#identitycheck">IdentityCheck</a></code> configuration.</p>
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf <div class="warning">It is critical to only enable this behavior from
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin intermediate hosts (proxies, etc) which are trusted by this server, since
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin it is trivial for the remote client to impersonate another client.</div>
c1e61f5534383913a1cb952f927348037b1c1922minfrin<div id="quickview"><h3 class="directives">Directives</h3>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<li><img alt="" src="/images/down.gif" /> <a href="#remoteipheader">RemoteIPHeader</a></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><img alt="" src="/images/down.gif" /> <a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><img alt="" src="/images/down.gif" /> <a href="#remoteipinternalproxylist">RemoteIPInternalProxyList</a></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><img alt="" src="/images/down.gif" /> <a href="#remoteipproxiesheader">RemoteIPProxiesHeader</a></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><img alt="" src="/images/down.gif" /> <a href="#remoteiptrustedproxy">RemoteIPTrustedProxy</a></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><img alt="" src="/images/down.gif" /> <a href="#remoteiptrustedproxylist">RemoteIPTrustedProxyList</a></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><img alt="" src="/images/down.gif" /> <a href="#processing">Remote IP Processing</a></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><code class="module"><a href="/mod/mod_authz_host.html">mod_authz_host</a></code></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><code class="module"><a href="/mod/mod_status.html">mod_status</a></code></li>
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf<li><code class="module"><a href="/mod/mod_log_config.html">mod_log_config</a></code></li>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<li><code class="module"><a href="/mod/mod_ident.html">mod_ident</a></code></li>
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh<h2><a name="processing" id="processing">Remote IP Processing</a></h2>
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh <p>Apache identifies the client with the connection's remote_ip value,
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh and the connection remote_host and remote_logname are derived from this
e487d6c09669296f94a5190cc34586a98e624a00nd value. These fields play a role in authentication, authorization and
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf logging and other purposes by other loadable modules.</p>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <p>mod_remoteip replaces the true remote_ip with the advertised remote_ip as
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin provided by a proxy, for every evaluation of the client that occurs in the
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf server, and resets the remote_host and remote_logname values to trigger a
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin fresh dns or ident query of the remote IP address.</p>
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf <p>When multiple, comma delimited remote IP addresses are listed in the
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin header value, they are processed in Right-to-Left order. Processing
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin halts when a given remote IP address is not trusted to present the
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin preceeding IP address. The header field is updated to this remaining
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin list of unconfirmed IP addresses, or if all IP addresses were trusted,
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin this header is removed from the request altogether.</p>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin <p>In replacing the remote_ip, the module stores the list of intermediate
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin hosts in a remoteip-proxy-ip-list note, which <code class="module"><a href="/mod/mod_log_config.html">mod_log_config</a></code>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin can record using the <code>%{remoteip-proxy-ip-list}n</code> format token.
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin If the administrator needs to store this as an additional header, this
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin same value can also be recording as a header using the directive
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin <code class="directive">RemoteIPProxiesHeader</code>.</p>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin <div class="note"><h3>IPv4-over-IPv6 Mapped Addresses</h3>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin As with httpd in general, any IPv4-over-IPv6 mapped addresses are recorded
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin in their IPv4 representation.</div>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin <div class="note"><h3>Internal (Private) Addresses</h3>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin All internal addresses 10/8, 172.16/12, 192.168/16, 169.254/16 and 127/8
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin blocks (and IPv6 addresses outside of the public 2000::/3 block) are only
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin evaluated by mod_remoteip when <code class="directive">RemoteIPInternalProxy</code>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin internal (intranet) proxies are registered.</div>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<div class="directive-section"><h2><a name="RemoteIPHeader" id="RemoteIPHeader">RemoteIPHeader</a> <a name="remoteipheader" id="remoteipheader">Directive</a></h2>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which should be parsed for client IP addresses</td></tr>
c1e61f5534383913a1cb952f927348037b1c1922minfrin<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPHeader <var>header-field</var></code></td></tr>
c1e61f5534383913a1cb952f927348037b1c1922minfrin<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
c1e61f5534383913a1cb952f927348037b1c1922minfrin<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <p>The <code class="directive">RemoteIPHeader</code> directive triggers
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <code class="module"><a href="/mod/mod_remoteip.html">mod_remoteip</a></code> to treat the value of the specified
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <var>header-field</var> header as the client IP address, or list
c1e61f5534383913a1cb952f927348037b1c1922minfrin of intermediate client IP addresses, subject to further configuration
c1e61f5534383913a1cb952f927348037b1c1922minfrin of the <code class="directive">RemoteIPInternalProxy</code> and
c1e61f5534383913a1cb952f927348037b1c1922minfrin <code class="directive">RemoteIPTrustedProxy</code> directives. Unless these
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin other directives are used, <code class="module"><a href="/mod/mod_remoteip.html">mod_remoteip</a></code> will trust all
c1e61f5534383913a1cb952f927348037b1c1922minfrin hosts presenting a <code class="directive">RemoteIPHeader</code> IP value.</p>
fac8c35bfb158112226ab43ddf84d59daca5dc30nd <div class="example"><h3>Internal (Load Balancer) Example</h3><p><code>
e487d6c09669296f94a5190cc34586a98e624a00nd RemoteIPHeader X-Client-IP
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh RemoteIPHeader X-Forwarded-For
e487d6c09669296f94a5190cc34586a98e624a00nd<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh<div class="directive-section"><h2><a name="RemoteIPInternalProxy" id="RemoteIPInternalProxy">RemoteIPInternalProxy</a> <a name="remoteipinternalproxy" id="remoteipinternalproxy">Directive</a></h2>
c1e61f5534383913a1cb952f927348037b1c1922minfrin<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPInternalProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</code></td></tr>
e487d6c09669296f94a5190cc34586a98e624a00nd<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
e487d6c09669296f94a5190cc34586a98e624a00nd<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
2d24960fa1e6afc7ad5f1bf58b6b3f5e7a9a3497humbedooh <p>The <code class="directive">RemoteIPInternalProxy</code> directive adds one
e487d6c09669296f94a5190cc34586a98e624a00nd or more addresses (or address blocks) to trust as presenting a valid
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin RemoteIPHeader value of the client IP. Unlike the
c1e61f5534383913a1cb952f927348037b1c1922minfrin <code class="directive">RemoteIPTrustedProxy</code> directive, any IP address
c1e61f5534383913a1cb952f927348037b1c1922minfrin presented in this header, including private intranet addresses, are
c1e61f5534383913a1cb952f927348037b1c1922minfrin trusted when passed from these proxies.</p>
c1e61f5534383913a1cb952f927348037b1c1922minfrin <div class="example"><h3>Internal (Load Balancer) Example</h3><p><code>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin RemoteIPHeader X-Client-IP<br />
c1e61f5534383913a1cb952f927348037b1c1922minfrin RemoteIPTrustedProxy gateway.localdomain
c1e61f5534383913a1cb952f927348037b1c1922minfrin<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
c1e61f5534383913a1cb952f927348037b1c1922minfrin<div class="directive-section"><h2><a name="RemoteIPInternalProxyList" id="RemoteIPInternalProxyList">RemoteIPInternalProxyList</a> <a name="remoteipinternalproxylist" id="remoteipinternalproxylist">Directive</a></h2>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPInternalProxyList <var>filename</var></code></td></tr>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
e487d6c09669296f94a5190cc34586a98e624a00nd<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
e487d6c09669296f94a5190cc34586a98e624a00nd <p>The <code class="directive">RemoteIPInternalProxyList</code> directive specifies
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin a file parsed at startup, and builds a list of addresses (or address blocks)
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin to trust as presenting a valid RemoteIPHeader value of the client IP.</p>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <p>The '<code>#</code>' hash character designates a comment line, otherwise
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin each whitespace or newline separated entry is processed identically to
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin the <code class="directive">RemoteIPInternalProxy</code> directive.</p>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin <div class="example"><h3>Internal (Load Balancer) Example</h3><p><code>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin RemoteIPHeader X-Client-IP<br />
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <div class="example"><h3>conf/trusted-proxies.lst contents</h3><p><code>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin # Our internally trusted proxies;<br />
fac8c35bfb158112226ab43ddf84d59daca5dc30nd gateway.localdomain #The front end balancer
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin<div class="directive-section"><h2><a name="RemoteIPProxiesHeader" id="RemoteIPProxiesHeader">RemoteIPProxiesHeader</a> <a name="remoteipproxiesheader" id="remoteipproxiesheader">Directive</a></h2>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which will record all intermediate IP addresses</td></tr>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPProxiesHeader <var>HeaderFieldName</var></code></td></tr>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
6cb5ba7ba62cc211ade9e6b76f82eaae64a3a5d2minfrin<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <p>The <code class="directive">RemoteIPProxiesHeader</code> directive specifies
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin a header into which <code class="module"><a href="/mod/mod_remoteip.html">mod_remoteip</a></code> will collect a list of
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin all of the intermediate client IP addresses trusted to resolve the actual
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin remote IP. Note that intermediate <code class="directive">RemoteIPTrustedProxy</code>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin addresses are recorded in this header, while any intermediate
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin <code class="directive">RemoteIPInternalProxy</code> addresses are discarded.</p>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin RemoteIPHeader X-Forwarded-For<br />
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin RemoteIPProxiesHeader X-Forwarded-By
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<div class="directive-section"><h2><a name="RemoteIPTrustedProxy" id="RemoteIPTrustedProxy">RemoteIPTrustedProxy</a> <a name="remoteiptrustedproxy" id="remoteiptrustedproxy">Directive</a></h2>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPTrustedProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</code></td></tr>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin <p>The <code class="directive">RemoteIPTrustedProxy</code> directive adds one
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin or more addresses (or address blocks) to trust as presenting a valid
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin RemoteIPHeader value of the client IP. Unlike the
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin <code class="directive">RemoteIPInternalProxy</code> directive, any intranet
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin or private IP address reported by such proxies, including the 10/8, 172.16/12,
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin 192.168/16, 169.254/16 and 127/8 blocks (or outside of the IPv6 public
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin 2000::/3 block) are not trusted as the remote IP, and are left in the
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <code class="directive">RemoteIPHeader</code> header's value.</p>
4277c95b5a9454a5c25f8d8762634fcff37aa840minfrin <div class="example"><h3>Trusted (Load Balancer) Example</h3><p><code>
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung RemoteIPHeader X-Forwarded-For<br />
0d0ba3a410038e179b695446bb149cce6264e0abnd RemoteIPTrustedProxy proxy.example.com
cc7e1025de9ac63bd4db6fe7f71c158b2cf09fe4humbedooh<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
727872d18412fc021f03969b8641810d8896820bhumbedooh<div class="directive-section"><h2><a name="RemoteIPTrustedProxyList" id="RemoteIPTrustedProxyList">RemoteIPTrustedProxyList</a> <a name="remoteiptrustedproxylist" id="remoteiptrustedproxylist">Directive</a></h2>
0d0ba3a410038e179b695446bb149cce6264e0abnd<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
0d0ba3a410038e179b695446bb149cce6264e0abnd<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPTrustedProxyList <var>filename</var></code></td></tr>
ac082aefa89416cbdc9a1836eaf3bed9698201c8humbedooh<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
0d0ba3a410038e179b695446bb149cce6264e0abnd<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
0d0ba3a410038e179b695446bb149cce6264e0abnd<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
727872d18412fc021f03969b8641810d8896820bhumbedooh <p>The <code class="directive">RemoteIPTrustedProxyList</code> directive specifies
0d0ba3a410038e179b695446bb149cce6264e0abnd a file parsed at startup, and builds a list of addresses (or address blocks)
0d0ba3a410038e179b695446bb149cce6264e0abnd to trust as presenting a valid RemoteIPHeader value of the client IP.</p>
1a1356f375e36db7bee379ea0684ab389579f798rbowen <p>The '<code>#</code>' hash character designates a comment line, otherwise
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen each whitespace or newline seperated entry is processed identically to
0d0ba3a410038e179b695446bb149cce6264e0abnd the <code class="directive">RemoteIPTrustedProxy</code> directive.</p>
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd <div class="example"><h3>Trusted (Load Balancer) Example</h3><p><code>
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd RemoteIPHeader X-Forwarded-For<br />
proxy.isp.example.com #some well known ISP
<p><span>Available Languages: </span><a href="/en/mod/mod_remoteip.html" title="English"> en </a></p>
<p class="apache">Copyright 2009 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="/faq/">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p></div>