Getting real IP with caddy behind a reverse proxy

Mohammed90 · June 17, 2024, 6:06pm

It seems like Coraza is using the wrong value per this GitHub issue

wrong client ip when using with cloudflare tunnel

opened 11:38PM - 16 May 24 UTC

I am running caddy and cloudflared in containers. I expose the app through cloud…flare tunnel. Even though I see correct IP address for the user in the **client_ip** field in caddy HTTP access logs, I only see my local IP where my cloudflared container is running in "client" field in coraza's logs. ``` ERR ts=1715890755.5588253 logger=http.handlers.waf msg=[client "172.19.0.2"] Coraza: Access denied (phase 1). Restricted File Access Attempt [file "@owasp_crs/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "3004"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "critical"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname ""] [uri "/backup/.env"] [unique_id "cMcEsZeHrZypdcza"] ERR ts=1715890755.5638793 logger=http.handlers.waf msg=[client "172.19.0.2"] Coraza: Access denied (phase 2). Inbound Anomaly Score Exceeded (Total Score: 5) [file "@owasp_crs/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "6836"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "emergency"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname ""] [uri "/backup/.env"] [unique_id "cMcEsZeHrZypdcza"] ERR ts=1715901998.4102561 logger=http.handlers.waf msg=[client "172.19.0.2"] Coraza: Access denied (phase 1). Restricted File Access Attempt [file "@owasp_crs/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "3004"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "critical"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname ""] [uri "/server/.env"] [unique_id "gtdfrphGnOfXfwZS"] ERR ts=1715901998.8870468 logger=http.handlers.waf msg=[client "172.19.0.2"] Coraza: Access denied (phase 2). Inbound Anomaly Score Exceeded (Total Score: 5) [file "@owasp_crs/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "6836"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "emergency"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname ""] [uri "/server/.env"] [unique_id "gtdfrphGnOfXfwZS"] ``` In caddy logs, **remote_ip** field refers to 172.19.0.2 (my local cloudflared) As far as I remember caddy recommends to use "client_ip" field rather than "remote_ip" for the addons. that might be the case.