-
Notifications
You must be signed in to change notification settings - Fork 9
Open
Description
When using spoa on Haproxy the modproxy logs keep showing that the connected client is the haproxy itself (which in my case is 127.0.0.1, as I run the agent on the server in a docker) and modproxy logs this IP.
Is there a way to include the original source IP which connected to the HAproxy beforehand and pass it to modsecurity - in a forwarded for header for example?
The problem is that some features like geoip or ip reputation do not work on this scenario. Moreover when using siem-solution for logging the modsecurity logs and threats the connecting IP is always localhost.
Im looking forward to receive some tipps or even a solution how to handle this.
Thanks in advance.
ypereirareis, jessequinn, amitnarwal-sec, CorentinS6 and mat1010
Metadata
Metadata
Assignees
Labels
No labels