Tomcat: 'X-Forwarded-For' doesn't work with load balancer

Question

We are currently working on a redundant server setup (2 servers + 1 load balancer) using Tomcat 7 update 76. To fulfill the logging requirements of our company, we are trying to get the IP of the remote server, that actually sends the request, not the IP of the load balancer. Unfortunately we were not able to get it to work with the following documentation:

We used the following configuration for access logging and remote valve:

<Valve className="org.apache.catalina.valves.RemoteIpValve" internalProxies="xxx\.xxx\.xxx\.7|xxx\.xxx\.xxx\.8|xxx\.xxx\.xxx\.9"  remoteIpHeader="X-Forwarded-For" />
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="access_log." suffix=".log"
pattern="%{org.apache.catalina.AccessLog.RemoteAddr}r %l %u %t &quot;%r&quot; %s %b" 
requestAttributesEnabled="true" />

The request header 'X-Forwarded-For' was set and load balancer was analyzed via wireshark. However we still only get the IP of the load balancer and not the IP of the remote client. The IP adresses of the config have already been checked and they are correct.

what load-balancer are you using ? It may be configured to not insert the XFF header — Eugène Adell
The load balancer was tested with wireshark and shows the corresponding header field. It's difficult to look further into the configuration of the load balancer because it's managed by another provider. — Nkls155
Use Request Dumper Filter to see what Tomcat receives, it will answer if the LB is sending the XFF header or not. There are other ways to debug btw, I'm just giving an idea. — Eugène Adell
We enabled the Request Dumper Filter now. The requests from the load balancer include the following line: header=x-forwarded-for=yyy.yyy.yyy.yyy. — Nkls155
You can try increasing the log level of org.apache.catalina.valves.RemoteIpValve.level to FINE in logging.properties — Piotr P. Karwasz

Maxime Bélanger Maxime Bélanger · Accepted Answer · 2021-04-09T18:27:19

Changing the pattern of the AccessLogValve was the solution for me, like so :

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%{x-forwarded-for}i %l %u %t &quot;%r&quot; %s %b" />

source: https://stackoverflow.com/a/36357291/1830268

full pattern attribute options are here : https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#Access_Log_Valve/Attributes

Tomcat: 'X-Forwarded-For' doesn't work with load balancer

1 Answers