Getting real IP with caddy behind a reverse proxy

Help
1

1. The problem I’m having:

Hey

I have Caddy with Coraza WAF setup right now behind a reverse proxy (nginx). In the caddy request logs, all client ip fields are 127.0.0.1.

If I query Caddy directly, the logs are printed correctly.
This would make me think it’s an nginx issue, however:
If I run nc -lp 8080 and send a request through NGINX, the headers are correct (X-Real-IP, X-Forwarded-For, X-Forwarded-Host)

2. Error messages and/or full log output:

{"level":"error","ts":1718636999.067847,"logger":"http.handlers.waf","msg":"[client \"127.0.0.1\"] Coraza: Access den...

3. Caddy version:

Caddy version v2.8.4

4. How I installed and ran Caddy:

I built it with xcaddy

a. System environment:

Ubuntu 20.02

b. Command:

./caddy run --config Caddyfile

c. Service/unit/compose file:

d. My complete Caddy config:

{
        debug
        auto_https off
        order coraza_waf first
        log {
                format json
                level info
                output file /var/log/caddy/caddy_events.log
        }
}

:8080 {
        coraza_waf {
                load_owasp_crs
                directives `
                Include coraza.conf
                Include coreruleset/crs-setup.conf.example
                Include coreruleset/rules/*.conf
                SecRuleEngine On
                SecDebugLog /dev/stdout
                SecDebugLogLevel 9
                SecResponseBodyAccess On
                SecResponseBodyMimeType application/json
                `
        }
        reverse_proxy http://localhost
}

5. Links to relevant resources:

2

Caddy doesn’t blindly trust the X-Forwarded-For because it isn’t secure to just assume so. Anyone can point a reverse-proxy at your service. You need to set the trusted_proxies:

1 Like
3

For testing, I set my trusted_proxies to 0.0.0.0/0, and I am still getting the same issue.

{
        debug
        auto_https off
        order coraza_waf first
        log {
                format json
                level info
                output file /var/log/caddy/caddy_events.log
        }
        servers {
                trusted_proxies static 0.0.0.0/0
        }
}
:8080 {
        coraza_waf {
                load_owasp_crs
                directives `
                Include coraza.conf
                Include coreruleset/crs-setup.conf.example
                Include coreruleset/rules/*.conf
                SecRuleEngine On
                SecDebugLog /var/log/caddy/coraza.log
                SecDebugLogLevel 9
                SecAuditLogParts ABZ
                SecResponseBodyAccess On
                SecResponseBodyMimeType application/json
                `
        }
        reverse_proxy http://localhost
}

Is this the correct spot to set trusted_proxies?

4

It seems like Coraza is using the wrong value per this GitHub issue

1 Like
5

Yep, you’re correct lol.

I just edited the coraza module directly to use the header sent by my reverse proxy instead.
Thanks!

6

For posterity, can you share the final config? It’ll help future wanderers

2 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.