Forum Discussion

MSK_222682's avatar
MSK_222682
Icon for Nimbostratus rankNimbostratus
Mar 24, 2016

X-Forwarded-For header

Hi All,

My application team requirement is to able to see the actual client ip address whoever accessing the application instead of BIG IP address as SNAT (Auto map) is enabled. 

I have read some SOL on it and understand that we can achieve this by iRule & HTTP profile. However, my requirement is to have an iRule as we can take decision whether to add X-Forwarded-For header to client requests. 

Can anyone please share the iRule script pertaining to this requirement.

Thanks in advance,
MSK
application delivery
client ip
header insert
iRules
LTM
snat automap
x-forwarded-for
  • Vitaliy_Savrans's avatar
    Vitaliy_Savrans
    Icon for Nacreous rankNacreous
    Mar 24, 2016

    Hi, if you want to add X-Forwarded-For header you can use:

      when HTTP_REQUEST {
   HTTP::header replace X-Forwarded-For [IP::client_addr]
   }
    • MSK_222682's avatar
      MSK_222682
      Icon for Nimbostratus rankNimbostratus
      Mar 24, 2016
      Hi Vitaliy, Thanks for the quick response. Will this iRule insert X-Forwarded-For header for the client requests which already have it, which shouldn't be the case as per my requirement. -MSK
    • Vitaliy_Savrans's avatar
      Vitaliy_Savrans
      Icon for Nacreous rankNacreous
      Mar 24, 2016
      This irule will insert the header if it wasn't present or replace the value.
  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Mar 24, 2016

    Hello,

    You can use the following : 

    when HTTP_REQUEST {
  if {[HTTP::header exists X-Forwarded-For]}{
      HTTP::header replace X-Forwarded-For "[HTTP::header X-Forwarded-For], [IP::client_addr]"
  } else {  
      HTTP::header insert X-Forwarded-For [IP::client_addr]
  }
}
    • MSK_222682's avatar
      MSK_222682
      Icon for Nimbostratus rankNimbostratus
      Mar 24, 2016
      Hi Yann, Thanks for the quick response. Will this iRule insert X-Forwarded-For header for the client requests which already have it ?? Looking at the script my understanding is it would check if X-Forwarded-For header exists but cannot understand the replace and insert statements of the script. Can you please shed some light on it. -MSK
    • Yann_Desmarest's avatar
      Yann_Desmarest
      Icon for Cirrus rankCirrus
      Mar 24, 2016
      Hello, The irule provided add the client ip to an existing X- header otherwise, it will add a new one with the clientip. Insert allow you to add a new header. Replace add a new header if there is no existing header with the same name, otherwise it changes the value of an existing x- header
  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Icon for Nacreous rankNacreous
    Mar 24, 2016

    Hello,

    You can use the following : 

    when HTTP_REQUEST {
  if {[HTTP::header exists X-Forwarded-For]}{
      HTTP::header replace X-Forwarded-For "[HTTP::header X-Forwarded-For], [IP::client_addr]"
  } else {  
      HTTP::header insert X-Forwarded-For [IP::client_addr]
  }
}
    • MSK_222682's avatar
      MSK_222682
      Icon for Nimbostratus rankNimbostratus
      Mar 24, 2016
      Hi Yann, Thanks for the quick response. Will this iRule insert X-Forwarded-For header for the client requests which already have it ?? Looking at the script my understanding is it would check if X-Forwarded-For header exists but cannot understand the replace and insert statements of the script. Can you please shed some light on it. -MSK
    • Yann_Desmarest_'s avatar
      Yann_Desmarest_
      Icon for Nacreous rankNacreous
      Mar 24, 2016
      Hello, The irule provided add the client ip to an existing X- header otherwise, it will add a new one with the clientip. Insert allow you to add a new header. Replace add a new header if there is no existing header with the same name, otherwise it changes the value of an existing x- header