Setup as follows:
- proxy server (RHEL8 apache 2.4) in DMZ
- contains multiple vhosts
- each vhost acts as a reverse proxy to a web server in the LAN
- connections from the proxy to the backend web server are secured via SSL
- backend server (RHEL8 apache 2.4) in LAN
Problem to solve Currently the apache access log of the backend server shows the IP of the proxy instead of the originating client IP. I want to ensure the client IP (who is connecting to the proxy) to be logged in the access log of the backend apache server.
Numerous howto's on the web (e.g. How to get X-Forwarded-For IP addresses in Apache Web Server) propose to use
However it seems that this only works when the proxy connection to the backend uses HTTP. (discussion on linode forum.)
The proxy server has both the public and private keys of the SSL certifcate.
How can I configure the proxy server to add the
X-Forwarded-for header while keeping the SSL connection to the backend?
Virtual host configuration of the proxy server (with IP 192.168.1.2):
<VirtualHost *:443> ServerName service.example.com SSLEngine on SSLCipherSuite AES256+EECDH:AES256+EDH SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLCompression off SSLCertificateFile /etc/pki/tls/certs/service_example_com.crt SSLCertificateKeyFile /etc/pki/tls/private/service_example_com.key SSLCertificateChainFile /etc/pki/tls/certs/CA.crt SSLProxyEngine on ProxyPass / https://backend-1.anubex.com/ ProxyPassReverse / https://backend-1.anubex.com/ RemoteIPHeader X-Forwarded-For RemoteIPInternalProxy 192.168.1.2 </VirtualHost>