There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?

Short answer

A Trusted Proxy profile is created on the Load Balancer → Profiles → Trusted Proxies screen: the CDN's header is selected in the Real IP from field (Custom header + CF-Connecting-IP for Cloudflare, True-Client-IP for Akamai, X-Forwarded-For (last / most trusted) for a general proxy chain), and the IP ranges published by the CDN are entered manually in the Trusted Networks field. The profile is selected in the Trusted Proxy field in the Details list of the HTTP vService. TR7 uses the address in the header as the client IP only for connections coming from these networks; Conditions, WAF, Bot & DDoS Protection (Bot Protection, L7 DDoS Protection, IP Reputation Protection) and the logs see this address.

Problem: TR7 Sees All Requests as Coming from the CDN's IPs

If there is a CDN or proxy in front of TR7, the client connecting to TR7 is the CDN's edge server. When no profile is assigned, TR7 ignores the forwarded headers (X-Forwarded-For, etc.) and uses the address the connection comes from. In this case, the logs, IP blacklists, country checks, the source IP counters of L7 DDoS Protection and the WAF see the CDN, not the real visitor; blocking one visitor means blocking all the CDN traffic. The real address is in the header added by the CDN, but this header must be trusted only when it comes from the CDN.

Solution: 2 Methods

The two methods create the same profile from different screens; the result is the same.

Your situation	Suitable method
I want to create the profile in advance and assign it to one or more vServices	Method 1: From the Profiles menu
I want to create the profile while editing the vService	Method 2: New profile from the vService form

Method 1: From the Profiles Menu Recommended

• How it works For connections coming from the trusted networks, the profile makes the address in the specified header the client address; for other connections, the header is not taken into account (it is not deleted, it is forwarded to the Backend Service as it is). If there is more than one source, they are evaluated in order and the first match is applied.
• Where it is openedLoad Balancer → Profiles → Trusted Proxies · vService → Details → Trusted Proxy
• Requirement The IP ranges published by the CDN; HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; the Load Balancer → Profiles → Trusted Proxies path is followed and Add is clicked (Profile Add Form).

2

Adım 2 Enter the name

A unique name is written in the Trusted Proxy Profile Name field.

3

Adım 3 Select the header

In the first source under Sources, Real IP from is selected: for Cloudflare, Custom header and Header Name = CF-Connecting-IP; for Akamai, Custom header and True-Client-IP; for general setups with more than one proxy layer, X-Forwarded-For (last / most trusted) (default).

4

Adım 4 Enter the trusted networks

The IPv4 and IPv6 ranges published by the CDN are entered in CIDR form in the Trusted Networks field (at least one; the netmask box comes with 24 and is corrected manually for IPv6); they are added with a new row (+). The ranges do not come to TR7 automatically; they are taken from the list published by the CDN. For more than one CDN, a new source is added to the Sources field with (+).

5

Adım 5 Save the profile

The Add button is clicked.

6

Adım 6 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and the edit form is opened with Edit.

7

Adım 7 Select the profile

In the Details list, the Trusted Proxy box is checked and the profile is selected in the Trusted Proxy Profile field.

8

Adım 8 Save

The Save button is clicked. In a cluster, the change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Real IPHTTP Logs

On the HTTP Logs screen of the vService, different visitor IPs are seen in the client address and location columns instead of CDN addresses.

ExpectedVisitor IPs (not CDN ranges)

2Profile appliedLoad Balancer Management

On the Load Balancer Management screen of the vService, the sentence stating that the real IP is resolved through the profile appears.

ExpectedTrusted proxy sentence

Method 2: New Profile from the vService Form

• How it works The profile is created in the window opened from the vService form and is selected in the field automatically.
• Where it is opened vService → Details → Trusted Proxy → Add in the drop-down list
• Requirement The IP ranges published by the CDN; HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and opened with Edit.

2

Adım 2 Open the profile window

In the Details list, the Trusted Proxy box is checked; the profile window is opened with Add in the drop-down list of the Trusted Proxy Profile field.

3

Adım 3 Define the profile

Trusted Proxy Profile Name, Real IP from (Header Name if needed) and Trusted Networks are entered as in steps 2–4 of Method 1.

4

Adım 4 Save the profile

The Add button in the window is clicked; the profile is selected in the field automatically.

5

Adım 5 Save

The vService form is saved with Save.

Verification

1Real IPHTTP Logs

On the HTTP Logs screen of the vService, different visitor IPs are seen instead of CDN addresses.

ExpectedVisitor IPs

Common Mistakes

• Thinking that the X-Forwarded-For option resolves the real IP. The X-Forwarded-For option on the vService only adds a header to the request going to the Backend Service; Trusted Proxy resolves the real IP from the incoming header. If a profile is assigned, the X-Forwarded-For going to the Backend Service also carries the resolved address.
• Creating the profile and not assigning it to the vService. A profile that is not assigned has no effect.
• Entering the trusted networks too broadly. Ranges such as 0.0.0.0/0 are applied and allow anyone to write a fake IP into the header (the form shows a warning for the /0 and /1 prefixes but does not prevent saving); only the CDN's ranges are entered (What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?).
• Not updating the CDN ranges. When the CDN adds a new range, the real IP is not resolved for requests coming from these ranges; the list is checked regularly.
• Allowing direct access to TR7. It is ensured with a firewall that TR7 is accessed only from the CDN; for directly incoming connections, the header is not used anyway, but the visitors have bypassed the CDN.

How it is done in the documentation

• Trusted Proxy · What Is the Trusted Proxies Profile?
• Trusted Proxy · Real IP from
• Trusted Proxy · Trusted Networks
• Trusted Proxy · The Components That Use the Resolved Address

Related questions

• What is the difference between the "Real IP from" options in the Trusted Proxy profile (X-Forwarded-For (last / most trusted), X-Forwarded-For (first), Custom Header)?
• What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?
• Which components use the IP resolved by Trusted Proxy (log, condition, WAF, Bot & DDoS Protection)?