Obtaining the client IP address with Lighttpd

Use Lighttpd's mod_extforward module to read the client-IP header sent by your HTTP(S) proxy. Confirm that your distribution provides the module and enable it using that package's configuration method.

Configure mod_extforward

  1. Open the configuration, usually /etc/lighttpd/lighttpd.conf, in your editor (for example, nano /etc/lighttpd/lighttpd.conf). Enable mod_extforward in server.modules or the distribution's module configuration. Do not load it twice. Before Lighttpd 1.4.61, load it after mod_accesslog for the substituted address to appear in access logs; that ordering requirement is unnecessary in 1.4.61 and later.
  2. Add the header and trusted source configuration:
extforward.headers = ("X-Real-IP")
extforward.forwarder = ("192.0.2.10" => "trust")

Replace 192.0.2.10 with a current Backend Communication IP Address from your service's Dashboard. Add an entry for every current source. If you changed Backend Real IP Header in HTTP Options, configure that header instead.

Check compatibility and reload

Lighttpd versions before 1.4.70 have limitations when an HTTP/2 backend connection carries concurrent requests for different clients. Upgrade, or configure the proxy-to-Lighttpd connection to use HTTP/1.1. The visitor-facing HTTP version is a separate setting.

  1. Test the configuration, for example with lighttpd -tt -f /etc/lighttpd/lighttpd.conf; use your installation's actual path.
  2. Reload using the distribution's service-management method.
  3. Verify the client address in both access logs and the application using a request through the protected hostname.
  4. Verify that an untrusted connection cannot substitute an address with a forged header. Keep any firewall protection against direct backend access enabled.

See the Real IP overview and Lighttpd mod_extforward reference.