Flood Control Does Not Use Correct IP Address

Question

In settings.php I've done the following:

/* Turn on reverse proxy */

$settings['reverse_proxy'] = TRUE;

/* Set reverse proxy (load balancer) address */

$settings['reverse_proxy_addresses'] = ['a.b.c.d']; //test-bnc4-web1

/* Enabled trusted headers */

$settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;

I'm still not getting the correct client IP in the log when a user fails to login because of an invalid username. It is reporting the second IP address in $_SERVER['X_FORWARDED_FOR'] where $_SERVER['X_FORWARDED_FOR'] = 'a.b.c.d, e.f.g.h' The first IP is the correct one. The second is a switch.

This is important if an IP gets blocked.

Answer 1

Based on this Symfony Framework pull request, you have to add all intermediate proxies to reverse_proxy_addresses for the actual client IP to resolve properly.

The documentation in settings.php above reverse_proxy_addresses reads:

In order for this setting to be used you must specify every possible reverse proxy IP address in $settings['reverse_proxy_addresses'].