[users@httpd] Sending client's IP address to local proxied application server.

[Mike Diehl]

Hi all,

I've got an application server, written in Perl Dancer2, that needs to get
access to the client's actual IP address.  But instead, it's getting the IP
address of the apache server.
Both the Apache and application server are running on the same hardware.
Here is how I have the vhost defined: (sanitized)

 <VirtualHost *:443>
         SSLEngine on
         SSLCertificateFile /etc/ssl/www.example.com/WWW.EXAMPLE.COM.crt
         SSLCertificateKeyFile /etc/ssl/www.example.com/server.key
         SSLCertificateChainFile /etc/ssl/
www.example.com/OV_NetworkSolutionsOVServerCA2.crt

         ServerAdmin webmaster@localhost
         ServerName example.com
         ServerAlias www.example.com *.example.com
         DocumentRoot /web/hw/
         DirectoryIndex index.cfm
         ErrorLog ${APACHE_LOG_DIR}/error.log
         CustomLog ${APACHE_LOG_DIR}/access.log combined

         <Location "/apps/">
           ProxyPass "http://127.0.0.1:8080/apps/";
         </Location>

 </VirtualHost>

I have mod_remoteid installed and configured:

r...@example.com:/etc/apache2# cat conf-enabled/remoteip.conf

RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 127.0.0.1 198.101.193.34

But when I access a URL that runs on the app server, the app server gets
127.0.0.1 as the client's address.

Looking at the HTTP headers doesn't yield the correct results, either:


accept ->
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
accept-encoding -> gzip, deflate, br
accept-language -> en-US,en;q=0.5
connection -> Keep-Alive
host -> 127.0.0.1:8080
upgrade-insecure-requests -> 1
user-agent -> Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:81.0)
Gecko/20100101 Firefox/81.0
x-forwarded-for -> 198.101.193.34
x-forwarded-host -> www.example.com
x-forwarded-server -> example.com


The value of the x-forwarded-for header is the outside interface on the
Apache server, NOT the client's address.

What have I done wrong?

Thanks in advance,

Mike.