Skip to content

forwarding Source IP as client IP #2

Description

@Rdago

When using spoa on Haproxy the modproxy logs keep showing that the connected client is the haproxy itself (which in my case is 127.0.0.1, as I run the agent on the server in a docker) and modproxy logs this IP.

Is there a way to include the original source IP which connected to the HAproxy beforehand and pass it to modsecurity - in a forwarded for header for example?

The problem is that some features like geoip or ip reputation do not work on this scenario. Moreover when using siem-solution for logging the modsecurity logs and threats the connecting IP is always localhost.

Im looking forward to receive some tipps or even a solution how to handle this.

Thanks in advance.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions