Use iRulke to extract X-Forwarded out of HTTP packet

So it sounds like the client is making more than one HTTP request on the same TCP connection. If that happens, the HTTP profile and iRule would no longer be enabled, so the XFF header would not be inserted. That's the downside to disabling the HTTP profile.

 

 

If you want to insert the XFF header in every request on a TCP connection, you would need to collect the TCP payload and search every packet for some delimiter like HTTP/1.0\r\n or HTTP/1.1\r\n and replace it with HTTP/1.x\r\nX-Forwarded-For: [IP::client_addr]\r\n where x is the HTTP version. You could also potentially do this with a stream profile as the HTTP headers (not the payload) would be modified.

 

 

The easiest option though would be to change the servers' default gateway and remove the SNAT.

 

 

Aaron