mod_remoteip.html.en revision 2e545ce2450a9953665f701bb05350f0d3f26275
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe This file is generated from xml source: DO NOT EDIT
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<link href="/style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<link href="/style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen<link href="/style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="/style/css/prettify.css" />
2e545ce2450a9953665f701bb05350f0d3f26275nd<script src="/style/scripts/prettify.min.js" type="text/javascript">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<link href="/images/favicon.ico" rel="shortcut icon" /></head>
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="up"><a href="./"><img title="<-" alt="<-" src="/images/left.gif" /></a></div>
3f08db06526d6901aa08c110b5bc7dde6bc39905nd<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.5</a> > <a href="./">Modules</a></div>
0066eddda7203f6345b56f77d146a759298dc635gryzor<p><span>Available Languages: </span><a href="/en/mod/mod_remoteip.html" title="English"> en </a> |
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung<a href="/fr/mod/mod_remoteip.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a></p>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Replaces the original client IP address for the connection
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrinwith the useragent IP address list presented by a proxies or a load balancer
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrinvia the request headers.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="module-dict.html#ModuleIdentifier">Module�Identifier:</a></th><td>remoteip_module</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="module-dict.html#SourceFile">Source�File:</a></th><td>mod_remoteip.c</td></tr></table>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <p>This module is used to treat the useragent which initiated the
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin request as the originating useragent as identified by httpd for the
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin purposes of authorization and logging, even where that useragent is
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe behind a load balancer, front end server, or proxy server.</p>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <p>The module overrides the client IP address for the connection
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin with the useragent IP address reported in the request header configured
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin with the <code class="directive">RemoteIPHeader</code> directive.</p>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <p>Once replaced as instructed, this overridden useragent IP address is
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin then used for the <code class="module"><a href="/mod/mod_authz_host.html">mod_authz_host</a></code>
b244bbf442a0aea3dc397b4d0d751f4716c5891dnd <code class="directive"><a href="/mod/mod_authz_core.html#require">Require ip</a></code>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin feature, is reported by <code class="module"><a href="/mod/mod_status.html">mod_status</a></code>, and is recorded by
57b31f30545668d28e895efe7f5c0eb15d37a03figalic <code class="module"><a href="/mod/mod_log_config.html">mod_log_config</a></code> <code>%a</code> and <code class="module"><a href="/mod/core.html">core</a></code>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <code>%a</code> format strings. The underlying client IP of the connection
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin is available in the <code>%{c}a</code> format string.</p>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <div class="warning">It is critical to only enable this behavior from
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe intermediate hosts (proxies, etc) which are trusted by this server, since
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin it is trivial for the remote useragent to impersonate another
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin useragent.</div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div id="quickview"><h3 class="directives">Directives</h3>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><img alt="" src="/images/down.gif" /> <a href="#remoteipheader">RemoteIPHeader</a></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><img alt="" src="/images/down.gif" /> <a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><img alt="" src="/images/down.gif" /> <a href="#remoteipinternalproxylist">RemoteIPInternalProxyList</a></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><img alt="" src="/images/down.gif" /> <a href="#remoteipproxiesheader">RemoteIPProxiesHeader</a></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><img alt="" src="/images/down.gif" /> <a href="#remoteiptrustedproxy">RemoteIPTrustedProxy</a></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><img alt="" src="/images/down.gif" /> <a href="#remoteiptrustedproxylist">RemoteIPTrustedProxyList</a></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><img alt="" src="/images/down.gif" /> <a href="#processing">Remote IP Processing</a></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><code class="module"><a href="/mod/mod_authz_host.html">mod_authz_host</a></code></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><code class="module"><a href="/mod/mod_status.html">mod_status</a></code></li>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<li><code class="module"><a href="/mod/mod_log_config.html">mod_log_config</a></code></li>
30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<h2><a name="processing" id="processing">Remote IP Processing</a></h2>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <p>Apache by default identifies the useragent with the connection's
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin client_ip value, and the connection remote_host and remote_logname are
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin derived from this value. These fields play a role in authentication,
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin authorization and logging and other purposes by other loadable
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin modules.</p>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <p>mod_remoteip overrides the client IP of the connection with the
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin advertised useragent IP as provided by a proxy or load balancer, for
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin the duration of the request. A load balancer might establish a long
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin lived keepalive connection with the server, and each request will
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin have the correct useragent IP, even though the underlying client IP
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin address of the load balancer remains unchanged.</p>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <p>When multiple, comma delimited useragent IP addresses are listed in the
27dcd8d81085fd60aadcd8a9bad35a607b26b758nilgun header value, they are processed in Right-to-Left order. Processing
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin halts when a given useragent IP address is not trusted to present the
57b31f30545668d28e895efe7f5c0eb15d37a03figalic preceding IP address. The header field is updated to this remaining
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe list of unconfirmed IP addresses, or if all IP addresses were trusted,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe this header is removed from the request altogether.</p>
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin <p>In overriding the client IP, the module stores the list of intermediate
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe hosts in a remoteip-proxy-ip-list note, which <code class="module"><a href="/mod/mod_log_config.html">mod_log_config</a></code>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe can record using the <code>%{remoteip-proxy-ip-list}n</code> format token.
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe If the administrator needs to store this as an additional header, this
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe same value can also be recording as a header using the directive
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="directive">RemoteIPProxiesHeader</code>.</p>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <div class="note"><h3>IPv4-over-IPv6 Mapped Addresses</h3>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe As with httpd in general, any IPv4-over-IPv6 mapped addresses are recorded
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe in their IPv4 representation.</div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <div class="note"><h3>Internal (Private) Addresses</h3>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe All internal addresses 10/8, 172.16/12, 192.168/16, 169.254/16 and 127/8
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe blocks (and IPv6 addresses outside of the public 2000::/3 block) are only
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe evaluated by mod_remoteip when <code class="directive">RemoteIPInternalProxy</code>
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf internal (intranet) proxies are registered.</div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="directive-section"><h2><a name="RemoteIPHeader" id="RemoteIPHeader">RemoteIPHeader</a> <a name="remoteipheader" id="remoteipheader">Directive</a></h2>
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which should be parsed for useragent IP addresses</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPHeader <var>header-field</var></code></td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf <p>The <code class="directive">RemoteIPHeader</code> directive triggers
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="module"><a href="/mod/mod_remoteip.html">mod_remoteip</a></code> to treat the value of the specified
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin <var>header-field</var> header as the useragent IP address, or list
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin of intermediate useragent IP addresses, subject to further configuration
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe of the <code class="directive">RemoteIPInternalProxy</code> and
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="directive">RemoteIPTrustedProxy</code> directives. Unless these
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe other directives are used, <code class="module"><a href="/mod/mod_remoteip.html">mod_remoteip</a></code> will trust all
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe hosts presenting a <code class="directive">RemoteIPHeader</code> IP value.</p>
e487d6c09669296f94a5190cc34586a98e624a00nd <div class="example"><h3>Internal (Load Balancer) Example</h3><pre class="prettyprint lang-config">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe RemoteIPHeader X-Client-IP
e487d6c09669296f94a5190cc34586a98e624a00nd <div class="example"><h3>Proxy Example</h3><pre class="prettyprint lang-config">
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe RemoteIPHeader X-Forwarded-For
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="directive-section"><h2><a name="RemoteIPInternalProxy" id="RemoteIPInternalProxy">RemoteIPInternalProxy</a> <a name="remoteipinternalproxy" id="remoteipinternalproxy">Directive</a></h2>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPInternalProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</code></td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <p>The <code class="directive">RemoteIPInternalProxy</code> directive adds one
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe or more addresses (or address blocks) to trust as presenting a valid
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin RemoteIPHeader value of the useragent IP. Unlike the
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="directive">RemoteIPTrustedProxy</code> directive, any IP address
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf presented in this header, including private intranet addresses, are
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe trusted when passed from these proxies.</p>
e487d6c09669296f94a5190cc34586a98e624a00nd <div class="example"><h3>Internal (Load Balancer) Example</h3><pre class="prettyprint lang-config">
17ade6df5ec233536985eb1c130a906c725dd614humbedoohRemoteIPHeader X-Client-IP
53c8c4e968f092ac29976710db5829444e4c11fahumbedoohRemoteIPInternalProxy gateway.localdomain
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="directive-section"><h2><a name="RemoteIPInternalProxyList" id="RemoteIPInternalProxyList">RemoteIPInternalProxyList</a> <a name="remoteipinternalproxylist" id="remoteipinternalproxylist">Directive</a></h2>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPInternalProxyList <var>filename</var></code></td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <p>The <code class="directive">RemoteIPInternalProxyList</code> directive specifies
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe a file parsed at startup, and builds a list of addresses (or address blocks)
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <p>The '<code>#</code>' hash character designates a comment line, otherwise
27dcd8d81085fd60aadcd8a9bad35a607b26b758nilgun each whitespace or newline separated entry is processed identically to
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe the <code class="directive">RemoteIPInternalProxy</code> directive.</p>
53c8c4e968f092ac29976710db5829444e4c11fahumbedooh <div class="example"><h3>Internal (Load Balancer) Example</h3><pre class="prettyprint lang-config">
53c8c4e968f092ac29976710db5829444e4c11fahumbedoohRemoteIPHeader X-Client-IP
d86b74ee886d1e6d05a867cdbe5091f07a68b8adnd <div class="example"><h3>conf/trusted-proxies.lst contents</h3><pre>
17ade6df5ec233536985eb1c130a906c725dd614humbedooh# Our internally trusted proxies;
17ade6df5ec233536985eb1c130a906c725dd614humbedoohgateway.localdomain #The front end balancer
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="directive-section"><h2><a name="RemoteIPProxiesHeader" id="RemoteIPProxiesHeader">RemoteIPProxiesHeader</a> <a name="remoteipproxiesheader" id="remoteipproxiesheader">Directive</a></h2>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which will record all intermediate IP addresses</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPProxiesHeader <var>HeaderFieldName</var></code></td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <p>The <code class="directive">RemoteIPProxiesHeader</code> directive specifies
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe a header into which <code class="module"><a href="/mod/mod_remoteip.html">mod_remoteip</a></code> will collect a list of
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin all of the intermediate client IP addresses trusted to resolve the useragent
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin IP of the request. Note that intermediate
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin <code class="directive">RemoteIPTrustedProxy</code> addresses are recorded in
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrin this header, while any intermediate
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="directive">RemoteIPInternalProxy</code> addresses are discarded.</p>
e487d6c09669296f94a5190cc34586a98e624a00nd <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">
17ade6df5ec233536985eb1c130a906c725dd614humbedoohRemoteIPHeader X-Forwarded-For
17ade6df5ec233536985eb1c130a906c725dd614humbedoohRemoteIPProxiesHeader X-Forwarded-By
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="directive-section"><h2><a name="RemoteIPTrustedProxy" id="RemoteIPTrustedProxy">RemoteIPTrustedProxy</a> <a name="remoteiptrustedproxy" id="remoteiptrustedproxy">Directive</a></h2>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPTrustedProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</code></td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <p>The <code class="directive">RemoteIPTrustedProxy</code> directive adds one
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe or more addresses (or address blocks) to trust as presenting a valid
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin RemoteIPHeader value of the useragent IP. Unlike the
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf <code class="directive">RemoteIPInternalProxy</code> directive, any intranet
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe or private IP address reported by such proxies, including the 10/8, 172.16/12,
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe 192.168/16, 169.254/16 and 127/8 blocks (or outside of the IPv6 public
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin 2000::/3 block) are not trusted as the useragent IP, and are left in the
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <code class="directive">RemoteIPHeader</code> header's value.</p>
e487d6c09669296f94a5190cc34586a98e624a00nd <div class="example"><h3>Trusted (Load Balancer) Example</h3><pre class="prettyprint lang-config">
17ade6df5ec233536985eb1c130a906c725dd614humbedoohRemoteIPHeader X-Forwarded-For
17ade6df5ec233536985eb1c130a906c725dd614humbedoohRemoteIPTrustedProxy proxy.example.com
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<div class="directive-section"><h2><a name="RemoteIPTrustedProxyList" id="RemoteIPTrustedProxyList">RemoteIPTrustedProxyList</a> <a name="remoteiptrustedproxylist" id="remoteiptrustedproxylist">Directive</a></h2>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPTrustedProxyList <var>filename</var></code></td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <p>The <code class="directive">RemoteIPTrustedProxyList</code> directive specifies
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe a file parsed at startup, and builds a list of addresses (or address blocks)
c8ea2fd531ec56b7969ee48fc05655b503fa57a3minfrin to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <p>The '<code>#</code>' hash character designates a comment line, otherwise
48b62528cd9513fe8b5f1bbcee92ab3b28c94807rbowen each whitespace or newline separated entry is processed identically to
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe the <code class="directive">RemoteIPTrustedProxy</code> directive.</p>
e487d6c09669296f94a5190cc34586a98e624a00nd <div class="example"><h3>Trusted (Load Balancer) Example</h3><pre class="prettyprint lang-config">
17ade6df5ec233536985eb1c130a906c725dd614humbedoohRemoteIPHeader X-Forwarded-For
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe <div class="example"><h3>conf/trusted-proxies.lst contents</h3><p><code>
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe # Identified external proxies;<br />
5f4e50966b2b9b58436a1651cbe588d1b595657ewrowe proxy.isp.example.com #some well known ISP
0066eddda7203f6345b56f77d146a759298dc635gryzor<p><span>Available Languages: </span><a href="/en/mod/mod_remoteip.html" title="English"> en </a> |
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung<a href="/fr/mod/mod_remoteip.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a></p>
727872d18412fc021f03969b8641810d8896820bhumbedooh</div><div class="top"><a href="#page-header"><img src="/images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
727872d18412fc021f03969b8641810d8896820bhumbedoohvar comments_shortname = 'httpd';
cc7e1025de9ac63bd4db6fe7f71c158b2cf09fe4humbedoohvar comments_identifier = 'http://httpd.apache.org/docs/trunk/mod/mod_remoteip.html';
0d0ba3a410038e179b695446bb149cce6264e0abnd(function(w, d) {
cc7e1025de9ac63bd4db6fe7f71c158b2cf09fe4humbedooh if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
727872d18412fc021f03969b8641810d8896820bhumbedooh d.write('<div id="comments_thread"><\/div>');
0d0ba3a410038e179b695446bb149cce6264e0abnd var s = d.createElement('script');
ac082aefa89416cbdc9a1836eaf3bed9698201c8humbedooh s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
0d0ba3a410038e179b695446bb149cce6264e0abnd (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
727872d18412fc021f03969b8641810d8896820bhumbedooh d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
0d0ba3a410038e179b695446bb149cce6264e0abnd})(window, document);
07dc96d063d49299da433f84b5c5681da9bbdf68rbowen<p class="apache">Copyright 2014 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
0d0ba3a410038e179b695446bb149cce6264e0abndif (typeof(prettyPrint) !== 'undefined') {
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd prettyPrint();