| docs

Appearance

Remote IP Handling ​

Remote IP Handling tells the web server which header carries the real visitor address, and which proxies are allowed to set it. It is what a server behind Cloudflare or another CDN needs so that logs, statistics and blocking work on visitors rather than on the CDN.

Added in AdminBolt 1.7.0.

Overview ​

URL: /admin/my-apache-settings and /admin/litespeed-settings, under the modules section, as Remote IP Handling.

The settings are shared: whichever of the two pages you edit them on, they apply to the web server that is active. You do not have to configure them twice after switching web servers.

The problem it solves ​

When a CDN sits in front of the server, every request arrives from the CDN's own address. Without this setting the server sees the CDN, so access logs show CDN addresses, visitor statistics count the CDN as a single visitor, the IP Blocker blocks the CDN instead of an abuser, login protection bans the CDN, and REMOTE_ADDR in a script is the CDN.

With the header and the trust list configured, all of those read the visitor's own address again.

Fields ​

  • Remote IP header is the name of the header carrying the real visitor address, for example CF-Connecting-IP for Cloudflare. Leave it empty to load the module without trusting any header.
  • Trusted proxies are the IP addresses and CIDR ranges allowed to set that header. A request from any other address keeps its real source address, so a header forged directly at the server is ignored.
  • Internal proxies is optional and names internal load balancers whose header is also trusted.

Fill Cloudflare ranges fills the header name and the published Cloudflare ranges in one click.

Apache reads the header you name here. LiteSpeed always uses X-Forwarded-For, which Cloudflare and most CDNs send alongside their own header, so the same configuration works on both.

The trust list is mandatory ​

Warning: Setting a header without a trust list would let anyone who reaches the server directly forge that header and pretend to be any address, including one on an allowlist. The panel refuses to apply that combination and tells you to add at least one trusted proxy first.

If your server is reachable directly as well as through the CDN, the trust list is the only thing separating a real visitor address from a claimed one.

What starts using the visitor address ​

Once applied, all of these read the visitor's own address:

The client Access Logs viewer also gains a Remote Host column, so an account owner can see the visitor address the server recorded.

Applying ​

Save with Apply Configuration. The setting is stored once and applied to the active web server.