Gecko [ v3.cesa.co.za ]

Name	Size	Permission	Date
core.html	306.8 KB	-rw-r--r--	2026-06-12 05:08
directive-dict.html	18 KB	-rw-r--r--	2026-06-12 05:08
directives.html	58.06 KB	-rw-r--r--	2026-06-12 05:08
event.html	28.64 KB	-rw-r--r--	2026-06-12 05:08
index.html	24.33 KB	-rw-r--r--	2026-06-12 05:08
mod_access_compat.html	28.27 KB	-rw-r--r--	2026-06-12 05:08
mod_actions.html	12.61 KB	-rw-r--r--	2026-06-12 05:08
mod_alias.html	40.63 KB	-rw-r--r--	2026-06-12 05:08
mod_allowmethods.html	7.79 KB	-rw-r--r--	2026-06-12 05:08
mod_asis.html	8.65 KB	-rw-r--r--	2026-06-12 05:08
mod_auth_basic.html	19.39 KB	-rw-r--r--	2026-06-12 05:08
mod_auth_digest.html	20.06 KB	-rw-r--r--	2026-06-12 05:08
mod_auth_form.html	50.26 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_anon.html	16.37 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_core.html	16.45 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_dbd.html	15.01 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_dbm.html	12.48 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_file.html	11.17 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_socache.html	18.79 KB	-rw-r--r--	2026-06-12 05:08
mod_authnz_fcgi.html	26.93 KB	-rw-r--r--	2026-06-12 05:08
mod_authnz_ldap.html	86.06 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_core.html	39.59 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_dbd.html	18.13 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_dbm.html	12.7 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_groupfile.html	10.24 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_host.html	13.12 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_owner.html	11 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_user.html	7.91 KB	-rw-r--r--	2026-06-12 05:08
mod_autoindex.html	63.19 KB	-rw-r--r--	2026-06-12 05:08
mod_brotli.html	22.65 KB	-rw-r--r--	2026-06-12 05:08
mod_buffer.html	8.76 KB	-rw-r--r--	2026-06-12 05:08
mod_cache.html	69.74 KB	-rw-r--r--	2026-06-12 05:08
mod_cache_disk.html	20.06 KB	-rw-r--r--	2026-06-12 05:08
mod_cache_socache.html	18.21 KB	-rw-r--r--	2026-06-12 05:08
mod_cern_meta.html	10.83 KB	-rw-r--r--	2026-06-12 05:08
mod_cgi.html	19.94 KB	-rw-r--r--	2026-06-12 05:08
mod_cgid.html	11.36 KB	-rw-r--r--	2026-06-12 05:08
mod_charset_lite.html	15.11 KB	-rw-r--r--	2026-06-12 05:08
mod_data.html	7.2 KB	-rw-r--r--	2026-06-12 05:08
mod_dav.html	19.88 KB	-rw-r--r--	2026-06-12 05:08
mod_dav_fs.html	10.54 KB	-rw-r--r--	2026-06-12 05:08
mod_dav_lock.html	9.51 KB	-rw-r--r--	2026-06-12 05:08
mod_dbd.html	24.89 KB	-rw-r--r--	2026-06-12 05:08
mod_deflate.html	31.15 KB	-rw-r--r--	2026-06-12 05:08
mod_dialup.html	7.2 KB	-rw-r--r--	2026-06-12 05:08
mod_dir.html	23.75 KB	-rw-r--r--	2026-06-12 05:08
mod_dumpio.html	9.41 KB	-rw-r--r--	2026-06-12 05:08
mod_echo.html	7.16 KB	-rw-r--r--	2026-06-12 05:08
mod_env.html	11.48 KB	-rw-r--r--	2026-06-12 05:08
mod_example_hooks.html	11.01 KB	-rw-r--r--	2026-06-12 05:08
mod_expires.html	17.21 KB	-rw-r--r--	2026-06-12 05:08
mod_ext_filter.html	18.05 KB	-rw-r--r--	2026-06-12 05:08
mod_file_cache.html	15.2 KB	-rw-r--r--	2026-06-12 05:08
mod_filter.html	33.35 KB	-rw-r--r--	2026-06-12 05:08
mod_headers.html	34.06 KB	-rw-r--r--	2026-06-12 05:08
mod_heartbeat.html	9.29 KB	-rw-r--r--	2026-06-12 05:08
mod_heartmonitor.html	11.92 KB	-rw-r--r--	2026-06-12 05:08
mod_http2.html	75.84 KB	-rw-r--r--	2026-06-12 05:08
mod_ident.html	9.74 KB	-rw-r--r--	2026-06-12 05:08
mod_imagemap.html	21.06 KB	-rw-r--r--	2026-06-12 05:08
mod_include.html	59.69 KB	-rw-r--r--	2026-06-12 05:08
mod_info.html	14.52 KB	-rw-r--r--	2026-06-12 05:08
mod_isapi.html	23.44 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_bybusyness.html	7.6 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_byrequests.html	12.3 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_bytraffic.html	7.95 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_heartbeat.html	8.02 KB	-rw-r--r--	2026-06-12 05:08
mod_ldap.html	50.89 KB	-rw-r--r--	2026-06-12 05:08
mod_log_config.html	38.27 KB	-rw-r--r--	2026-06-12 05:08
mod_log_debug.html	9.95 KB	-rw-r--r--	2026-06-12 05:08
mod_log_forensic.html	12.64 KB	-rw-r--r--	2026-06-12 05:08
mod_logio.html	10.29 KB	-rw-r--r--	2026-06-12 05:08
mod_lua.html	93.06 KB	-rw-r--r--	2026-06-12 05:08
mod_macro.html	15.29 KB	-rw-r--r--	2026-06-12 05:08
mod_md.html	109.91 KB	-rw-r--r--	2026-06-12 05:08
mod_mime.html	66.05 KB	-rw-r--r--	2026-06-12 05:08
mod_mime_magic.html	16.52 KB	-rw-r--r--	2026-06-12 05:08
mod_negotiation.html	21.68 KB	-rw-r--r--	2026-06-12 05:08
mod_nw_ssl.html	9.27 KB	-rw-r--r--	2026-06-12 05:08
mod_privileges.html	29.36 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy.html	137.06 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_ajp.html	32.56 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_balancer.html	23.03 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_connect.html	9.85 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_express.html	13.19 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_fcgi.html	22.14 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_fdpass.html	7.2 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_ftp.html	18.84 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_hcheck.html	17.43 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_html.html	34.16 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_http.html	11.63 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_http2.html	10.05 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_scgi.html	14.49 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_uwsgi.html	8.15 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_wstunnel.html	10.73 KB	-rw-r--r--	2026-06-12 05:08
mod_ratelimit.html	6.72 KB	-rw-r--r--	2026-06-12 05:08
mod_reflector.html	8.28 KB	-rw-r--r--	2026-06-12 05:08
mod_remoteip.html	26.54 KB	-rw-r--r--	2026-06-12 05:08
mod_reqtimeout.html	12.49 KB	-rw-r--r--	2026-06-12 05:08
mod_request.html	9.03 KB	-rw-r--r--	2026-06-12 05:08
mod_rewrite.html	82.27 KB	-rw-r--r--	2026-06-12 05:08
mod_sed.html	11.53 KB	-rw-r--r--	2026-06-12 05:08
mod_session.html	35.31 KB	-rw-r--r--	2026-06-12 05:08
mod_session_cookie.html	13.55 KB	-rw-r--r--	2026-06-12 05:08
mod_session_crypto.html	17.73 KB	-rw-r--r--	2026-06-12 05:08
mod_session_dbd.html	25.2 KB	-rw-r--r--	2026-06-12 05:08
mod_setenvif.html	21.77 KB	-rw-r--r--	2026-06-12 05:08
mod_slotmem_plain.html	7.76 KB	-rw-r--r--	2026-06-12 05:08
mod_slotmem_shm.html	8.36 KB	-rw-r--r--	2026-06-12 05:08
mod_so.html	13.5 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_dbm.html	5.82 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_dc.html	5.87 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_memcache.html	8.34 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_redis.html	10 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_shmcb.html	5.9 KB	-rw-r--r--	2026-06-12 05:08
mod_speling.html	12.64 KB	-rw-r--r--	2026-06-12 05:08
mod_ssl.html	200.72 KB	-rw-r--r--	2026-06-12 05:08
mod_status.html	11.84 KB	-rw-r--r--	2026-06-12 05:08
mod_substitute.html	14.37 KB	-rw-r--r--	2026-06-12 05:08
mod_suexec.html	7.89 KB	-rw-r--r--	2026-06-12 05:08
mod_systemd.html	7.57 KB	-rw-r--r--	2026-06-12 05:08
mod_unique_id.html	14.89 KB	-rw-r--r--	2026-06-12 05:08
mod_unixd.html	13.54 KB	-rw-r--r--	2026-06-12 05:08
mod_userdir.html	12.36 KB	-rw-r--r--	2026-06-12 05:08
mod_usertrack.html	19.68 KB	-rw-r--r--	2026-06-12 05:08
mod_version.html	10.05 KB	-rw-r--r--	2026-06-12 05:08
mod_vhost_alias.html	21.12 KB	-rw-r--r--	2026-06-12 05:08
mod_watchdog.html	7.73 KB	-rw-r--r--	2026-06-12 05:08
mod_xml2enc.html	15.3 KB	-rw-r--r--	2026-06-12 05:08
module-dict.html	9.17 KB	-rw-r--r--	2026-06-12 05:08
mpm_common.html	70.04 KB	-rw-r--r--	2026-06-12 05:08
mpm_netware.html	9.82 KB	-rw-r--r--	2026-06-12 05:08
mpm_winnt.html	10.58 KB	-rw-r--r--	2026-06-12 05:08
mpmt_os2.html	7.5 KB	-rw-r--r--	2026-06-12 05:08
overrides.html	69.49 KB	-rw-r--r--	2026-06-12 05:08
prefork.html	15.96 KB	-rw-r--r--	2026-06-12 05:08
quickreference.html	193.75 KB	-rw-r--r--	2026-06-12 05:08
worker.html	15.23 KB	-rw-r--r--	2026-06-12 05:08

Rename

<!DOCTYPE html SYSTEM "about:legacy-compat">
<html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta content="width=device-width, initial-scale=1" name="viewport">

<title>mod_remoteip - Apache HTTP Server Version 2.4</title>
<link href="../../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet">
<link href="../../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size">
<link href="../../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css"><link rel="stylesheet" type="text/css" href="../../style/css/prettify.css">
<script src="../../style/scripts/prettify.min.js">
</script>

<p>This module is used to treat the useragent which initiated the
    request as the originating useragent as identified by httpd for the
    purposes of authorization and logging, even where that useragent is
    behind a load balancer, front end server, or proxy server.</p>

<p>The module overrides the client IP address for the connection
    with the useragent IP address reported in the request header configured
    with the <code class="directive"><a href="#remoteipheader">RemoteIPHeader</a></code> directive.</p>

<p>Additionally, this module implements the server side of
    HAProxy's
    <a href="https://www.haproxy.org/download/3.1/doc/proxy-protocol.txt">PROXY Protocol</a> when
    using the <code class="directive"><a href="#remoteipproxyprotocol">RemoteIPProxyProtocol</a></code>
    directive.</p>

<p>Once replaced as instructed, this overridden useragent IP address is
    then used for the <code class="module"><a href="../mod/mod_authz_host.html">mod_authz_host</a></code>
    <code class="directive"><a href="../mod/mod_authz_core.html#require">Require ip</a></code>
    feature, is reported by <code class="module"><a href="../mod/mod_status.html">mod_status</a></code>, and is recorded by
    <code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code> <code>%a</code> and <code class="module"><a href="../mod/core.html">core</a></code>
    <code>%a</code> format strings. The underlying client IP of the connection
    is available in the <code>%{c}a</code> format string and via the
    <code>CONN_REMOTE_ADDR</code> variable in
    <a href="../expr.html">expressions</a>.</p>

<div class="warning">It is critical to only enable this behavior from
    intermediate hosts (proxies, etc) which are trusted by this server, since
    it is trivial for the remote useragent to impersonate another
    useragent.</div>
</div>
<div id="quickview"><h3>Topics</h3>
<ul id="topics">
<li><img alt="" src="../../images/down.gif"> <a href="#processing">Remote IP Processing</a></li>
</ul><h3 class="directives">Directives</h3>
<ul id="toc">
<li><img alt="" src="../../images/down.gif"> <a href="#remoteipheader">RemoteIPHeader</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#remoteipinternalproxylist">RemoteIPInternalProxyList</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#remoteipproxiesheader">RemoteIPProxiesHeader</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#remoteipproxyprotocol">RemoteIPProxyProtocol</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#remoteipproxyprotocolexceptions">RemoteIPProxyProtocolExceptions</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#remoteiptrustedproxy">RemoteIPTrustedProxy</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#remoteiptrustedproxylist">RemoteIPTrustedProxyList</a></li>
</ul>
<h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_remoteip">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_remoteip">Report a bug</a></li></ul><h3>See also</h3>
<ul class="seealso">
<li><code class="module"><a href="../mod/mod_authz_host.html">mod_authz_host</a></code></li>
<li><code class="module"><a href="../mod/mod_status.html">mod_status</a></code></li>
<li><code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code></li>
<li><a href="https://www.haproxy.org/download/3.1/doc/proxy-protocol.txt">Proxy Protocol Spec</a></li>
</ul></div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="section">
<h2 id="processing">Remote IP Processing <a title="Permanent link" href="#processing" class="permalink">&para;</a></h2>

<p>Apache by default identifies the useragent with the connection's
    client_ip value, and the connection remote_host and remote_logname are
    derived from this value. These fields play a role in authentication,
    authorization and logging and other purposes by other loadable
    modules.</p>

<p>mod_remoteip overrides the client IP of the connection with the
    advertised useragent IP as provided by a proxy or load balancer, for
    the duration of the request. A load balancer might establish a long
    lived keepalive connection with the server, and each request will
    have the correct useragent IP, even though the underlying client IP
    address of the load balancer remains unchanged.</p>

<p>When multiple, comma delimited useragent IP addresses are listed in the
    header value, they are processed in Right-to-Left order.  Processing
    halts when a given useragent IP address is not trusted to present the
    preceding IP address.  The header field is updated to this remaining
    list of unconfirmed IP addresses, or if all IP addresses were trusted,
    this header is removed from the request altogether.</p>

<p>In overriding the client IP, the module stores the list of intermediate
    hosts in a remoteip-proxy-ip-list note, which <code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code>
    can record using the <code>%{remoteip-proxy-ip-list}n</code> format token.
    If the administrator needs to store this as an additional header, this
    same value can also be recording as a header using the directive
    <code class="directive"><a href="#remoteipproxiesheader">RemoteIPProxiesHeader</a></code>.</p>

<div class="note"><h3>IPv4-over-IPv6 Mapped Addresses</h3>
    As with httpd in general, any IPv4-over-IPv6 mapped addresses are recorded
    in their IPv4 representation.</div>

<div class="note"><h3>Internal (Private) Addresses</h3>
    All internal addresses 10/8, 172.16/12, 192.168/16, 169.254/16 and 127/8
    blocks (and IPv6 addresses outside of the public 2000::/3 block) are only
    evaluated by mod_remoteip when <code class="directive"><a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></code>
    internal (intranet) proxies are registered.</div>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteipheader"><span id="RemoteIPHeader">RemoteIPHeader</span> Directive <a title="Permanent link" href="#remoteipheader" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which should be parsed for useragent IP addresses</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPHeader <var>header-field</var></code></td></tr>
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
</table>
    <p>The <code class="directive">RemoteIPHeader</code> directive triggers
    <code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> to treat the value of the specified
    <var>header-field</var> header as the useragent IP address, or list
    of intermediate useragent IP addresses, subject to further configuration
    of the <code class="directive"><a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></code> and
    <code class="directive"><a href="#remoteiptrustedproxy">RemoteIPTrustedProxy</a></code> directives.  Unless these
    other directives are used, <code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> will trust all
    hosts presenting a <code class="directive">RemoteIPHeader</code> IP value.</p>

<div class="example"><h3>Internal (Load Balancer) Example</h3><pre class="prettyprint lang-config">RemoteIPHeader X-Client-IP</pre>
</div>

<div class="example"><h3>Proxy Example</h3><pre class="prettyprint lang-config">RemoteIPHeader X-Forwarded-For</pre>
</div>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteipinternalproxy"><span id="RemoteIPInternalProxy">RemoteIPInternalProxy</span> Directive <a title="Permanent link" href="#remoteipinternalproxy" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPInternalProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
</table>
    <p>The <code class="directive">RemoteIPInternalProxy</code> directive adds one
    or more addresses (or address blocks) to trust as presenting a valid
    RemoteIPHeader value of the useragent IP.  Unlike the
    <code class="directive"><a href="#remoteiptrustedproxy">RemoteIPTrustedProxy</a></code> directive, any IP address
    presented in this header, including private intranet addresses, are
    trusted when passed from these proxies.</p>

<div class="example"><h3>Internal (Load Balancer) Example</h3><pre class="prettyprint lang-config">RemoteIPHeader X-Client-IP
RemoteIPInternalProxy 10.0.2.0/24
RemoteIPInternalProxy gateway.localdomain</pre>
</div>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteipinternalproxylist"><span id="RemoteIPInternalProxyList">RemoteIPInternalProxyList</span> Directive <a title="Permanent link" href="#remoteipinternalproxylist" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPInternalProxyList <var>filename</var></code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
</table>
    <p>The <code class="directive">RemoteIPInternalProxyList</code> directive specifies
    a file parsed at startup, and builds a list of addresses (or address blocks)
    to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>

<p>The '<code>#</code>' hash character designates a comment line, otherwise
    each whitespace or newline separated entry is processed identically to
    the <code class="directive"><a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></code> directive.</p>

<div class="example"><h3>Internal (Load Balancer) Example</h3><pre class="prettyprint lang-config">RemoteIPHeader X-Client-IP
RemoteIPInternalProxyList conf/trusted-proxies.lst</pre>
</div>

<div class="example"><h3>conf/trusted-proxies.lst contents</h3><pre># Our internally trusted proxies;
10.0.2.0/24         #Everyone in the testing group
gateway.localdomain #The front end balancer</pre></div>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteipproxiesheader"><span id="RemoteIPProxiesHeader">RemoteIPProxiesHeader</span> Directive <a title="Permanent link" href="#remoteipproxiesheader" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare the header field which will record all intermediate IP addresses</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPProxiesHeader <var>HeaderFieldName</var></code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
</table>
    <p>The <code class="directive">RemoteIPProxiesHeader</code> directive specifies
    a header into which <code class="module"><a href="../mod/mod_remoteip.html">mod_remoteip</a></code> will collect a list of
    all of the intermediate client IP addresses trusted to resolve the useragent
    IP of the request. Note that intermediate
    <code class="directive"><a href="#remoteiptrustedproxy">RemoteIPTrustedProxy</a></code> addresses are recorded in
    this header, while any intermediate
    <code class="directive"><a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></code> addresses are discarded.</p>

<div class="example"><h3>Example</h3><pre class="prettyprint lang-config">RemoteIPHeader X-Forwarded-For
RemoteIPProxiesHeader X-Forwarded-By</pre>
</div>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteipproxyprotocol"><span id="RemoteIPProxyProtocol">RemoteIPProxyProtocol</span> Directive <a title="Permanent link" href="#remoteipproxyprotocol" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable or disable PROXY protocol handling</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPProxyProtocol On|Off</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>RemoteIPProxyProtocol is only available in httpd 2.4.31 and newer</td></tr>
</table>
    <p>The <code class="directive">RemoteIPProxyProtocol</code> directive enables or 
    disables the reading and handling of the PROXY protocol connection header.
    If enabled with the <code>On</code> flag, the upstream client <em>must</em>
    send the header every time it opens a connection or the connection will
    be aborted unless it is in the list of disabled hosts provided by the
    <code class="directive"><a href="#remoteipproxyprotocolexceptions">RemoteIPProxyProtocolExceptions</a></code>
    directive.</p>

<p>While this directive may be specified in any virtual host, it is
    important to understand that because the PROXY protocol is connection
    based and protocol agnostic, the enabling and disabling is actually based
    on IP address and port. This means that if you have multiple name-based
    virtual hosts for the same host and port, and you enable it for any one of
    them, then it is enabled for all of them (with that host and port). It also
    means that if you attempt to enable the PROXY protocol in one and disable
    in the other, that won't work; in such a case, the last one wins and a
    notice will be logged indicating which setting was being overridden.</p>

<pre class="prettyprint lang-config">Listen 80
&lt;VirtualHost *:80&gt;
    ServerName www.example.com
    RemoteIPProxyProtocol On

#Requests to this virtual host must have a PROXY protocol
    # header provided. If it is missing, the connection will
    # be aborted
&lt;/VirtualHost&gt;

Listen 8080
&lt;VirtualHost *:8080&gt;
    ServerName www.example.com
    RemoteIPProxyProtocol On
    RemoteIPProxyProtocolExceptions 127.0.0.1 10.0.0.0/8

#Requests to this virtual host must have a PROXY protocol
    # header provided. If it is missing, the connection will
    # be aborted except when coming from localhost or the
    # 10.x.x.x RFC1918 range
&lt;/VirtualHost&gt;</pre>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteipproxyprotocolexceptions"><span id="RemoteIPProxyProtocolExceptions">RemoteIPProxyProtocolExceptions</span> Directive <a title="Permanent link" href="#remoteipproxyprotocolexceptions" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Disable processing of PROXY header for certain hosts or networks</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPProxyProtocolExceptions host|range [host|range] [host|range]</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>RemoteIPProxyProtocolExceptions is only available in httpd 2.4.31 and newer</td></tr>
</table>
    <p>The <code class="directive">RemoteIPProxyProtocol</code> directive enables or
    disables the reading and handling of the PROXY protocol connection header.
    Sometimes it is desirable to require clients to provide the PROXY header, but
    permit other clients to connect without it. This directive allows a server 
    administrator to configure a single host or CIDR range of hosts that may do
    so. This is generally useful for monitoring and administrative traffic to a 
    virtual host direct to the server behind the upstream load balancer.</p>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteiptrustedproxy"><span id="RemoteIPTrustedProxy">RemoteIPTrustedProxy</span> Directive <a title="Permanent link" href="#remoteiptrustedproxy" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPTrustedProxy <var>proxy-ip</var>|<var>proxy-ip/subnet</var>|<var>hostname</var> ...</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
</table>
    <p>The <code class="directive">RemoteIPTrustedProxy</code> directive adds one
    or more addresses (or address blocks) to trust as presenting a valid
    RemoteIPHeader value of the useragent IP.  Unlike the
    <code class="directive"><a href="#remoteipinternalproxy">RemoteIPInternalProxy</a></code> directive, any intranet
    or private IP address reported by such proxies, including the 10/8, 172.16/12,
    192.168/16, 169.254/16 and 127/8 blocks (or outside of the IPv6 public
    2000::/3 block) are not trusted as the useragent IP, and are left in the
    <code class="directive"><a href="#remoteipheader">RemoteIPHeader</a></code> header's value.</p>

<div class="example"><h3>Trusted (Load Balancer) Example</h3><pre class="prettyprint lang-config">RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 10.0.2.16/28
RemoteIPTrustedProxy proxy.example.com</pre>
</div>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="remoteiptrustedproxylist"><span id="RemoteIPTrustedProxyList">RemoteIPTrustedProxyList</span> Directive <a title="Permanent link" href="#remoteiptrustedproxylist" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Declare client intranet IP addresses trusted to present the RemoteIPHeader value</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>RemoteIPTrustedProxyList <var>filename</var></code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_remoteip</td></tr>
</table>
    <p>The <code class="directive">RemoteIPTrustedProxyList</code> directive specifies
    a file parsed at startup, and builds a list of addresses (or address blocks)
    to trust as presenting a valid RemoteIPHeader value of the useragent IP.</p>

<p>The '<code>#</code>' hash character designates a comment line, otherwise
    each whitespace or newline separated entry is processed identically to
    the <code class="directive"><a href="#remoteiptrustedproxy">RemoteIPTrustedProxy</a></code> directive.</p>

<div class="example"><h3>Trusted (Load Balancer) Example</h3><pre class="prettyprint lang-config">RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxyList conf/trusted-proxies.lst</pre>
</div>

<div class="example"><h3>conf/trusted-proxies.lst contents</h3><p><code>
       # Identified external proxies;<br>
       192.0.2.16/28         #wap phone group of proxies<br>
       proxy.isp.example.com #some well known ISP
    </code></p></div>

</div>
</div>
<div class="bottomlang">
<p><span>Available Languages: </span><a href="../../en/mod/mod_remoteip.html" title="English">&nbsp;en&nbsp;</a> |
<a href="../../fr/mod/mod_remoteip.html" hreflang="fr" rel="alternate" title="Fran&ccedil;ais">&nbsp;fr&nbsp;</a></p>
</div><div id="footer">
<p class="apache">Copyright 2026 The Apache Software Foundation.<br>Licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
<p class="menu"><a href="../mod/index.html">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="https://cwiki.apache.org/confluence/display/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a> | <a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2">Report a bug</a></p></div><script><![CDATA[//><!]]></script>
</body></html>