You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Ernst Kazimir <er...@home.nl> on 2004/02/26 23:54:02 UTC
[users@httpd] ip-address empty for x-forwarded-for
Hi there,
I'm using Apache 1.3 on Debian Linux for quite some time now. Apache is behind a Microsoft ISA Server firewall and serves 5 domains to the public on the internet. No problems!
Now I'm interested in the visitors of my website, so i like to use the access.log to feed the AWStats CGI script. This also seems to work fine, only the clients ip-address is allways the address of my ISA firewall. So I activated the module "libapache-mod-proxy-add-forward" and added the following new logformat to the httpd.conf file:
Logformat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b"
Now my IP address column in the access log reports only "- - - -"
I've crawled the internet for many hours but can't find any in depth information on configuring this right, so my last hope is in finding the answer on this mailing list.
I think that there's need certain thing to be set in the httpd.conf file that I'ven't done?
Or Microsft ISA server hides the internet ip-addresses from the systems on the LAN? If this could be the case I wonder how to test this and finaly solve it?
Best Regards,
Ernst Kazimir
Re: [users@httpd] ip-address empty for x-forwarded-for
Posted by Brian Dessent <br...@dessent.net>.
Ernst Kazimir wrote:
> Thanks for your answer and swift reply. I'm already searching the internet
> on specific information about what ISA Server does to it's headers. I've
> found the following remark :
> "During my working experience with Microsoft ISA Server 2000 and IIS 5.x/6.0
> I often had the problem that it would be nice to know the IP address of the
> remote host. But unfortunately the ISA Server replaces the values in the
> header fields Remote-Host and Remote-Addr with its internal address (if you
> are using Web Publishing). The most common solution is to switch from Web
> Publishing Rules to Server Publishing Rules (ISA Server)."
>
> I know that I'm making use of Web Publishing rules in ISA Server so because
> I'ven't got ISA at home I will test this in the morning in the office.
Here's a good thread from Google groups on the topic:
<http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&c2coff=1&safe=off&th=258cbe18ab5ad352&seekm=eSdQNTBvDHA.3224%40tk2msftngp13.phx.gbl&frame=off>
The consensus seems to be to combine the information from the ISA WEBEXT
log when you do the access-log analysis. I couldn't find anything
specifically about how to turn on the X-Forwarded-For header, but then
ISA isn't my bag.
Brian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] ip-address empty for x-forwarded-for
Posted by Ernst Kazimir <er...@home.nl>.
Hi Brain,
Thanks for your answer and swift reply. I'm already searching the internet
on specific information about what ISA Server does to it's headers. I've
found the following remark :
"During my working experience with Microsoft ISA Server 2000 and IIS 5.x/6.0
I often had the problem that it would be nice to know the IP address of the
remote host. But unfortunately the ISA Server replaces the values in the
header fields Remote-Host and Remote-Addr with its internal address (if you
are using Web Publishing). The most common solution is to switch from Web
Publishing Rules to Server Publishing Rules (ISA Server)."
I know that I'm making use of Web Publishing rules in ISA Server so because
I'ven't got ISA at home I will test this in the morning in the office.
I hope that it's the solution!
Kind Regards,
Ernst Kazimir
----- Original Message -----
From: "Brian Dessent" <br...@dessent.net>
To: <us...@httpd.apache.org>
Sent: Friday, February 27, 2004 12:02 AM
Subject: Re: [users@httpd] ip-address empty for x-forwarded-for
> > Ernst Kazimir wrote:
>
> > I'm using Apache 1.3 on Debian Linux for quite some time now. Apache
> > is behind a Microsoft ISA Server firewall and serves 5 domains to the
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > public on the internet. No problems!
> > ...
> > Now my IP address column in the access log reports only "- - - -"
> >
> > I've crawled the internet for many hours but can't find any in depth
> > information on configuring this right, so my last hope is in finding
>
> The header must be added by the proxy that's doing the forwarding
> (proxying.) In your case that's the MS ISA server. You'll have to turn
> it on there. This has nothing to do with Apache.
>
> Brian
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] ip-address empty for x-forwarded-for
Posted by Brian Dessent <br...@dessent.net>.
> Ernst Kazimir wrote:
> I'm using Apache 1.3 on Debian Linux for quite some time now. Apache
> is behind a Microsoft ISA Server firewall and serves 5 domains to the
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> public on the internet. No problems!
> ...
> Now my IP address column in the access log reports only "- - - -"
>
> I've crawled the internet for many hours but can't find any in depth
> information on configuring this right, so my last hope is in finding
The header must be added by the proxy that's doing the forwarding
(proxying.) In your case that's the MS ISA server. You'll have to turn
it on there. This has nothing to do with Apache.
Brian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org