The logs show the proxy / CDN IP instead of the client IP; what should I do?

Short answer

If there is a CDN, load balancer or reverse proxy in front of TR7, the connection comes to TR7 from the address of that device. If no Trusted Proxy profile is assigned to the vService, TR7 ignores the forwarded headers and WAF uses this address as the client. The effect is not limited to the logs: the Client IP, country and ASN information in Event Logs, Frontend Blacklist and Blacklist Protection, the Teacher IP and Conditional Learning IP matching, a Whitelist Condition based on the source IP, the client, country and ASN count of AI Learning, and Country Filter, Source IP Filter and Skip Blacklist IPs in the analysis also work with the proxy address. For the diagnosis, the X-Forwarded-For column, which is hidden by default, is opened in Event Logs; if Client IP is a few fixed addresses while different addresses appear in this column, this is the cause. The solution is to create a profile on the Load Balancer → Profiles → Trusted Proxies screen that defines the header in which the proxy carries the real address and the IP ranges of the proxy, and to select the profile in the Trusted Proxy field in the Details list of the HTTP vService. The address is resolved before the WAF inspection; in the records after the profile is assigned, Client IP shows the real client, and the earlier records do not change.

Problem: WAF Sees All Requests as Coming from the Proxy's Address

In the Client IP column of Event Logs, the same few addresses (CDN or proxy servers) repeat in every record; the country and network information also belongs to the proxy. In this case, all the IP-based functions of WAF work according to the proxy, not according to the real visitor: blacklisting an attacker's address means blocking all the proxy traffic, the test team's IP is not recognized even if it is defined as Teacher, and the client and country counts of the learning do not reach their thresholds.

Affected WAF Functions

TR7 resolves the client address before the WAF inspection; when the profile is assigned, all of the functions below use the resolved address (The Components That Use the Resolved Address).

Function	Address it uses without a profile	Effect
Event Logs Client IP, Attacker Location, Ip Provider	Proxy	The records show the address, country and network of the proxy
Frontend Blacklist, Blacklist Protection, Frontend Blacklist Exclusions	Proxy	Even if the real client is on the blacklist, it does not match; if the proxy address is blacklisted, all traffic is blocked
Teacher IP, Conditional Learning IP	Proxy	The defined team address is not recognized (Teacher traffic is not recognized; why?)
A Whitelist Condition with a source IP condition	Proxy	The condition is not evaluated according to the real client
AI Learning (Client, Country, ASN axes)	Proxy	All traffic appears to come from a few clients; the client and country thresholds are not reached (AI Learning produces no suggestions; why?)
Country Filter, Source IP Filter, Skip Blacklist IPs in the analysis	Proxy	The filters work according to the country and address of the proxy

Definitive rules:

• The profile makes the address in the header the client address only when the connection comes from the networks in the Trusted Networks field; in other connections, the header is not taken into account and the address the connection comes from is used.
• The resolution is not retroactive: the Event Logs records and the learning records written before the profile was assigned continue to carry the proxy address.
• The X-Forwarded-For column in Event Logs shows only the X-Forwarded-For header of the request; it does not change Client IP. Since the real address is already in Client IP after the profile is assigned, this column is opened only to examine the proxy chain.

How to Diagnose?

1. Left Monitor Panel → WAF-Protected vServices → vService → Event Logs is opened (accessing Event Logs).
2. The X-Forwarded-For column, which is hidden by default, is added from the Columns menu.
3. If different client addresses appear in the X-Forwarded-For column while the same few addresses repeat in the Client IP column, TR7 is behind a proxy and there is no resolution on the vService. The same comparison is also made with the Client IP and X-Forwarded-For tabs on the filter strip.
4. A record is clicked; if the Attacker IP on the Summary tab of the preview and the Ip provider value on the Request & Location tab show the CDN or proxy operator, the diagnosis is confirmed.
5. The header in which the proxy carries the real address (e.g. CF-Connecting-IP for Cloudflare) and the IP ranges it publishes are taken from the documentation of the proxy or CDN provider.

Solution

The networks of the proxy and the header in which the real address is carried are defined in a Trusted Proxy profile, and the profile is assigned to the vService. The profile also corrects the conditions and logs on the Load Balancer side, and Bot & DDoS Protection as well; for the difference between the options: What is the difference between the "Real IP from" options in the Trusted Proxy profile (X-Forwarded-For (last / most trusted), X-Forwarded-For (first), Custom Header)?

Trusted Proxy Profile

• How it works If the connection comes from a trusted proxy network, TR7 reads the client address from the selected header, and the WAF inspection, the logs, the blacklists and the learning use this address. If more than one source is defined, the sources are evaluated in order and the first match is applied.
• Where it is openedLoad Balancer → Profiles → Trusted Proxies · vService → Details → Trusted Proxy
• Requirement The header in which the proxy or CDN carries the real address and the IP ranges it publishes; no change is required on the Backend Service side
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; the Load Balancer → Profiles → Trusted Proxies path is followed and Add is clicked (Profile Add Form).

2

Adım 2 Enter the name

A unique name is written in the Trusted Proxy Profile Name field.

3

Adım 3 Select the header

In the first source under Sources, Real IP from is selected: for Cloudflare, Custom header and Header Name = CF-Connecting-IP; for Akamai, Custom header and True-Client-IP; in general setups with more than one proxy layer, X-Forwarded-For (last / most trusted) (default).

4

Adım 4 Enter the trusted networks

The IP ranges published by the proxy or CDN are entered in CIDR form in the Trusted Networks field (at least one); a new row is added with (+). The ranges do not come to TR7 on their own; they are taken from the list published by the provider. For more than one proxy, a new source is added to the Sources field with (+).

5

Adım 5 Save the profile

The Add button is clicked.

6

Adım 6 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the WAF-protected HTTP vService is selected and Edit is clicked.

7

Adım 7 Select the profile

In the Details list, the Trusted Proxy box is checked and the profile saved in step 5 is selected in the Trusted Proxy Profile field. If the profile was not created beforehand, the same form can also be opened from here with Add in the drop-down list of this field (How to Add to a vService?).

8

Adım 8 Save

Save is clicked; the resolution is applied, without a separate deployment step, to the requests that come from then on. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

On the WAF side after the profile is assigned

The records entered according to the proxy address before the profile was assigned do not change on their own; they are entered again manually according to the real client addresses: Frontend Blacklist and Frontend Blacklist Exclusions (Whitelist & Blacklist window), Teacher IP and Conditional Learning IP (Learning Methods window) and the Whitelist Condition based on the source IP. Since Country filter and Source IP Filter would work according to the proxy addresses in an analysis to be run with the learning records from before the profile, the analysis period is moved to after the profile was assigned (How do I keep attack traffic out of the analysis (country, blacklist, bot, status code, source IP filters)?).

Verification

1Client IPTR7 side

In Event Logs, Refresh on the toolbar is clicked; the Client IP column of the records written after the profile was assigned is compared with the X-Forwarded-For column.

ExpectedDifferent visitor addresses in Client IP; no proxy ranges

The list does not refresh on its own; a new record is created only on a request that exceeds the threshold or that triggers a signature in Monitor state. If there is no record, the same verification is done on the HTTP logs screen of the vService.

2Profile appliedLoad Balancer Management

On the Load Balancer Management screen of the vService, the sentence stating that the real IP is resolved through the profile is examined.

ExpectedThe real client IP is resolved from a header through the <profile> profile

Common Mistakes

Keeping the trusted networks wide

If a wide range is written in the Trusted Networks field instead of the proxy's ranges, a directly connecting client can report a fake address by writing the header itself; the blacklist can be bypassed or Teacher IP can be imitated. Only the ranges published by the proxy or CDN are entered in the field (What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?).

• Thinking that the X-Forwarded-For option on the vService resolves the real IP. The option on the vService only adds a header to the request that goes to the Backend Service; the real address is resolved from the incoming header by the Trusted Proxy profile.
• Creating the profile and not assigning it to the vService. A profile that is not assigned has no effect; the profile is selected in the Trusted Proxy field in the Details list of the vService and Save is clicked.
• Expecting the past records to be corrected. Only the requests after the profile is assigned are recorded with the real address.
• Deleting a profile in use. On the vService that uses the deleted profile, the resolution is disabled and the clients appear with the proxy address again; before deleting, the Used in tab in the profile preview is reviewed.
• Focusing only on correcting the logs. The blacklist, Teacher, Conditional learning, Whitelist condition and AI learning also use the same address; after the profile, these lists are reviewed according to the real addresses (Which components use the IP resolved by Trusted Proxy (log, condition, WAF, Bot & DDoS Protection)?).

How it is done in the documentation

• Trusted Proxies · The Components That Use the Resolved Address
• Trusted Proxies · How to Add?
• Event Logs · Columns
• Trusted Proxies · What Is the Trusted Proxies Profile?

Related questions

• There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?
• If there is a CDN / proxy in front of TR7, how does the WAF see the real client IP?
• Teacher traffic is not recognized; why?
• Which components use the IP resolved by Trusted Proxy (log, condition, WAF, Bot & DDoS Protection)?