mod_extforward¶

• Table of contents
• mod_extforward
  • Description
  • Options
  • Samples
  • Installation
  • Changes related to mod_extforward

Module: mod_extforward

Description¶

This module will extract the client's "real" IP from X-Forwarded-For
header which is added by Squid or other proxies. It might be useful
for servers behind reverse proxy servers.

Options¶

extforward.forwarder
Sets trust level of proxy IP's.
Default: empty

Example of usage:

    extforward.forwarder = ("10.0.0.232" => "trust")

will translate ip addresses coming from 10.0.0.232 to real ip addresses extracted from X-Forwarded-For: HTTP request header.

Important note:

The effect of this module is variable on $HTTP["remotip"] directives and other module's remote ip dependent actions.
Things done by modules before we change the remoteip or after we reset it will match on the proxy's IP.
Things done in between these two moments will match on the real client's IP.
The moment things are done by a module depends on in which hook it does things and within the same hook
on whether they are before/after us in the module loading order
(order in the server.modules directive in the config file).

Tested behaviours:

mod_access: Will match on the real client.

mod_accesslog: In order to see the "real" ip address in access log, you'll have to load mod_extforward after mod_accesslog, like this:

    server.modules  = (
       .....
       "mod_accesslog",
       "mod_extforward" 
    )

Samples¶

Trust proxy 10.0.0.232 and 10.0.0.233

  extforward.forwarder = (
     "10.0.0.232" => "trust",
     "10.0.0.233" => "trust" 
  )

Trust all proxies (NOT RECOMMENDED!)

  extforward.forwarder = ( "all" => "trust")

Note that "all" has precedence over specific entries, so "all except" setups will not work.

Installation¶

mod_extforward is included in lighttpd 1.4.14 and later,

Changes related to mod_extforward¶

• 1.4.19: Bug #1499: HTTPS env var should be "on" when using mod_extforward and the X-Forwarded-Proto header is set.
• 1.4.19: Bug #1528: support chained proxies in mod_extforward
• 1.4.14: r1665: added mod_extforward