For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rocket-boy_1877's avatar
Rocket-boy_1877
Icon for Nimbostratus rankNimbostratus
Jun 01, 2015

how to replace the address of the True-Client-ip header to x-forwarded-for header？

I am having issues passing the True-Client-IP from AKAMAI.

 

They pass the end users IP via a variable called True-CLient-IP

 

Does anyone know an easy way to be able replace from True-Client-ip addr to X-Forwarded-for addr.

 

===

 

I want to replace from the address of the True-Client-ip to x-forwarded-for. However, if the existing x-forwarded-for header, it is replace by overwriting, If not, inserting the x-forwarded-for.

 

forexample)

 

• True-Client-IP: 1.1.1.1 ==>X-FORWARD-FOR: 1.1.1.1

 

 

• True-Client-IP: 1.1.1.1 & X-FORWARD-FOR: 2.2.2.2,3.3.3.3 ==>X-FORWARD-FOR: 1.1.1.1

 

thank u

 

application delivery
BIG-IP Access Policy Manager (APM)
cisco
design
devops
iRules
LTM
security

4 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Jun 01, 2015

    e.g.

     configuration

[root@ve11a:Active:In Sync] config  tmsh list ltm rule qux
ltm rule qux {
    when HTTP_REQUEST {
  HTTP::header remove "X-Forwarded-For"
  HTTP::header insert "X-Forwarded-For" [HTTP::header "True-Client-IP"]
  HTTP::header remove "True-Client-IP"
}
}

 test 1

[root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.24.1(39911) <-> 172.28.24.10(80)
1433154499.9974 (0.0196)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
True-Client-IP: 1.1.1.1

---------------------------------------------------------------

New TCP connection 2: 200.200.200.14(39911) <-> 200.200.200.101(80)
1433154500.0255 (0.0263)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
X-Forwarded-For: 1.1.1.1

---------------------------------------------------------------

 test 2

[root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.24.1(39912) <-> 172.28.24.10(80)
1433154537.6090 (0.0015)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
True-Client-IP: 1.1.1.1
X-Forwarded-For: 2.2.2.2,3.3.3.3

---------------------------------------------------------------

New TCP connection 2: 200.200.200.14(39912) <-> 200.200.200.101(80)
1433154537.6109 (0.0016)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
X-Forwarded-For: 1.1.1.1

---------------------------------------------------------------

 test 3

[root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.24.1(39913) <-> 172.28.24.10(80)
1433154588.4812 (0.0024)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*

---------------------------------------------------------------

New TCP connection 2: 200.200.200.14(39913) <-> 200.200.200.101(80)
1433154588.4830 (0.0016)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
X-Forwarded-For:

---------------------------------------------------------------
    • Rocket-boy_1877's avatar
      Rocket-boy_1877
      Icon for Nimbostratus rankNimbostratus
      Jun 01, 2015
      Hi nitass, Thank u for your quick reply it's so simple! i will test this iRule BR
  • nitass_89166's avatar
    nitass_89166
    Icon for Noctilucent rankNoctilucent
    Jun 01, 2015

    e.g.

     configuration

[root@ve11a:Active:In Sync] config  tmsh list ltm rule qux
ltm rule qux {
    when HTTP_REQUEST {
  HTTP::header remove "X-Forwarded-For"
  HTTP::header insert "X-Forwarded-For" [HTTP::header "True-Client-IP"]
  HTTP::header remove "True-Client-IP"
}
}

 test 1

[root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.24.1(39911) <-> 172.28.24.10(80)
1433154499.9974 (0.0196)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
True-Client-IP: 1.1.1.1

---------------------------------------------------------------

New TCP connection 2: 200.200.200.14(39911) <-> 200.200.200.101(80)
1433154500.0255 (0.0263)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
X-Forwarded-For: 1.1.1.1

---------------------------------------------------------------

 test 2

[root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.24.1(39912) <-> 172.28.24.10(80)
1433154537.6090 (0.0015)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
True-Client-IP: 1.1.1.1
X-Forwarded-For: 2.2.2.2,3.3.3.3

---------------------------------------------------------------

New TCP connection 2: 200.200.200.14(39912) <-> 200.200.200.101(80)
1433154537.6109 (0.0016)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
X-Forwarded-For: 1.1.1.1

---------------------------------------------------------------

 test 3

[root@ve11a:Active:In Sync] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.24.1(39913) <-> 172.28.24.10(80)
1433154588.4812 (0.0024)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*

---------------------------------------------------------------

New TCP connection 2: 200.200.200.14(39913) <-> 200.200.200.101(80)
1433154588.4830 (0.0016)  C>S
---------------------------------------------------------------
HEAD / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.24.10
Accept: */*
X-Forwarded-For:

---------------------------------------------------------------
    • Rocket-boy_1877's avatar
      Rocket-boy_1877
      Icon for Nimbostratus rankNimbostratus
      Jun 01, 2015
      Hi nitass, Thank u for your quick reply it's so simple! i will test this iRule BR