Forum Discussion

Paul1209_361296's avatar
Paul1209_361296
Icon for Nimbostratus rankNimbostratus
May 16, 2018

IP address of DDOS provider being displayed instead of customer IP in XFF header

We recently implemented DDOS protection before our customer facing F5 and now the IP address being presented to the back-end application is the one for the DDOS provider rather than the customer IP.

 

The DDOS provider sends an XFF header and we have both the Insert X-Forwarded-For option enabled in the HTTP profile and the following irule defined:

 

when HTTP_REQUEST { HTTP::header insert X-Forwarded-For [IP::remote_addr] }

 

As described in K4816. Do I have to disable the HTTP profile for this to work.

 

Thanks

 

BIG-IP
iRules
security

1 Reply

Sort By
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    May 16, 2018

    Hello Paul,

     

    What you did is wrong, let me expain.

     

    The irule that you set allow you to insert XFF from F5 (you will send F5 IP to your backend). Example: you want to insert XFF for backend serveur you can use this Irule ou use HTTP profil by checking "Insert XFF".

     

    For me you have to remove this Irule from your VS and uncheck "Insert XFF" from HTTP profil.

     

    Normaly the backend have to received XFF header send by provider, F5 will FW it to the backend..

     

    Regards