The original filter that tracked a client IP address through a proxy chain on Microsoft Forefront TMG and ISA Server. This version is end-of-life; the IIS edition has been relaunched for Windows Server 2025.
Winfrasoft X-Forwarded-For added the ability to track and log the source IP address of a client PC through a forward or reverse proxy server chain to the web server. It brought this capability to Microsoft Forefront Threat Management Gateway, ISA Server and IIS — bringing them into line with Squid, Apache, F5 Big-IP, Blue Coat, Cisco Cache Engine and other proxy platforms that supported XFF natively.
This was ideal for log analysis when branch offices connected to the Internet via a head office proxy server, and when the real client IP address was required on a web server for accurate reporting and analysis.
IIS Web Server logging: X-Forwarded-For for IIS logged the real client IP address in the IIS c-ip field based on X-Forwarded-For header information. A Proxy Trust List ensured spoofed header information was dropped and only valid IPs were logged. The filter could also be configured to log the entire X-Forwarded-For header together with the layer 4 routed source IP address to record the complete proxy chain.
Forward proxy (outbound from TMG/ISA): The filter added the X-Forwarded-For field to the HTTP header of web requests leaving the proxy server. The new field contained the IP address of the original client PC.
Inbound into TMG/ISA: If the TMG/ISA Server received a proxy request containing the X-Forwarded-For field, the filter logged the XFF IP as the client IP address instead of the IP address of the requesting proxy server. The requesting proxy IP was added to the Filter Information field in the proxy logs.
Security: In forward proxy scenarios without a web chaining rule, the header was not added, preventing internal server IPs being revealed to the Internet. X-Forwarded-For header information originating from outside the organisation should never be trusted as the field is not signed or authenticated; the Proxy Trust List on the IIS server prevented spoofing.
This legacy edition supported Microsoft Forefront TMG 2010 and ISA Server 2004/2006 (along with IIS 6 through 8.5). The TMG and ISA Server editions are end-of-life and are not being redeveloped.
The IIS capability lives on: X-Forwarded-For for IIS has been rebuilt for IIS 10 on Windows Server 2016 through 2025 and is available now.