Log the real client IP address through forward and reverse proxy chains, directly in your IIS logs. Rebuilt from the ground up for modern IIS — fully supported on Windows Server 2025.
When client traffic reaches an IIS web server through a forward or reverse proxy, the IP address recorded in the IIS logs is the proxy's address — not the originating client's. Winfrasoft X-Forwarded-For for IIS solves this by reading the X-Forwarded-For HTTP header and logging the true client IP address in the standard IIS c-ip field, with no changes to your applications or downstream log analysis.
This is essential for geolocation services, accurate access reporting, security investigation and compliance requirements — particularly where branch offices, load balancers, CDNs or upstream proxies sit in front of your web servers.
Real client IP in the IIS log: X-Forwarded-For for IIS writes the originating client IP address into the IIS c-ip field based on the X-Forwarded-For header. Existing reporting, SIEM ingestion and log-analysis tooling continue to work unchanged — they simply see the correct client address.
Anti-spoofing: Because the X-Forwarded-For header is not signed or authenticated, header values originating from outside your organisation should never be trusted blindly. The Proxy Trust List ensures the header is only honoured when the request arrives from a known, trusted upstream proxy; values from any other source are dropped.
Complete chain visibility: Where requests pass through multiple proxies, the filter can be configured to log the full X-Forwarded-For header together with the routed source IP address, recording the entire path the request travelled.
Looking for the original Forefront TMG and ISA Server filter? That version is end-of-life and retained for reference on its legacy product page.
X-Forwarded-For for IIS is available now for evaluation and licensing. Get in touch for a trial build, pricing, or help planning a deployment across your IIS estate.
Request a trial or email info@winfrasoft.com