Practical, vendor-specific guides for logging the real client IP address in Microsoft IIS behind proxies, load balancers and CDNs, using the X-Forwarded-For header.
No guides match that search. Try a different term, or get in touch — X-Forwarded-For for IIS works behind any proxy, load balancer or CDN, whether or not there's a guide for it yet.
A table of the client IP headers set by Cloudflare, AWS, Azure, F5, ARR, Nginx, HAProxy, Akamai and Fastly, which are on by default, how the X-Forwarded-For chain is ordered, and why the leftmost address isn't the one to trust.
Read the reference →What the c-ip field records, how to read the W3C #Fields line, why a reverse proxy makes every log line identical, and how c-ip differs from a cs(X-Forwarded-For) custom column.
Read the reference →The questions we're asked most often: the c-ip field versus a custom log column, replacing the old F5 ISAPI filter on IIS 10, and Exchange behind a load balancer.
Read the FAQ →F5 archived its DevCentral ISAPI filter and F5XFFHttpModule HTTP module in 2016. Which component you have, what Microsoft says about IIS 10, why neither validates the forwarding chain, and how to migrate without changing anything downstream.
Read the guide →Why SIEM connectors, geo-IP lookups and compliance parsers all key off the standard c-ip field, why an extra log column doesn't satisfy them, and why an unvalidated header weakens an audit trail.
Read the guide →On-premises Exchange published through an F5, NetScaler or Azure Application Gateway logs the balancer's address for OWA and ActiveSync. Fixing the IIS audit trail, and the free native fix for IP Address and Domain Restrictions.
Read the guide →Multi-WFE SharePoint farms published through a load balancer log the proxy's address, not the visitor. Getting the real client IP into the IIS c-ip field farm-wide, and what this does and doesn't cover.
Read the guide →Neither proxy forwards the client IP unless you configure it to. The one directive each needs: proxy_set_header in Nginx, option forwardfor in HAProxy, and how to get the address into your IIS logs once it arrives.
Read the guide →Configuring ForwardedHeadersOptions properly: middleware order, KnownProxies, ForwardLimit, why it silently does nothing in production, and where it stops short of fixing the IIS log itself.
Read the guide →Behind Cloudflare, IIS logs the edge IP rather than the visitor. How to restore the real client IP in your IIS logs from the X-Forwarded-For header, with a Proxy Trust List and origin lock-down.
Read the guide →Behind an F5 BIG-IP, IIS logs the SNAT address. Enable Insert X-Forwarded-For on the HTTP profile and record the real client IP in your IIS c-ip field.
Read the guide →Behind an AWS ALB or Classic ELB, IIS logs the load balancer's private IP. Use the automatically-added X-Forwarded-For header to log the real visitor in IIS.
Read the guide →Behind Azure Application Gateway or Front Door, IIS logs the Azure service IP. Log the real client IP from X-Forwarded-For and trust the right Azure ranges.
Read the guide →With Application Request Routing as a reverse proxy, backend IIS logs the ARR server IP. Preserve the client IP via X-Forwarded-For and log it on the backend.
Read the guide →Need a setup we haven't covered? X-Forwarded-For for IIS works behind any proxy, load balancer or CDN that sets the X-Forwarded-For header. Get in touch and we'll help with your specific deployment.