how to set X-Real-IP HTTP header for Website Policy

[AMAK]

My website is WordPress, added the Wordfence WAF and it shows only my Firewall IP as the traffic hits. I am doing IP & port forwarding on the firewall 60F. The following is my firewall policy and VIP:

FG-60F (IPS1-website) $ show
config firewall vip
    edit "IPS1-website"
        set uuid 486s855e-c968-54gl-692f-36157e21b9c0
        set extip XX.XXX.XXX.XX
        set mappedip "192.168.1.54"
        set extintf "any"
        set portforward enable
        set extport 80
        set mappedport 84
    next
end


FG-60F $ config firewall policy

FG-60F (policy) $ edit 2

FG-60F (2) $ show
config firewall policy
    edit 2
        set name "WAN1-WP-web"
        set uuid 31b74efe-c96a-5wed-a157-fddc795fb4c0
        set srcintf "SD-WAN"
        set dstintf "internal"
        set action accept
        set srcaddr "all"
        set dstaddr "IPS1-website"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "certificate-inspection"
        set av-profile "default"
        set webfilter-profile "default"
        set dnsfilter-profile "default"
        set file-filter-profile "default"
        set ips-sensor "default"
        set application-list "default"
        set logtraffic all
        set nat enable
    next
end

I could not find "preserve client IP" as per this article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Preserve-client-IP-in-Virtual-servers/ta-p...

So How can I get it done? Where am I misconfigured my policy?

[saneeshpv_FTNT]

Hi @AMAK,

You just have to disable "nat" from the Firewall policy to get this working. This will make sure client Public IP address is not modified by FGT when sending the traffic to your WAF after matching the VIP.

Best Regards,

[AMAK]

I have disabled it, but the Wordfence WAF is still showing the firewall IP. 

[saneeshpv_FTNT · Accepted solution]

Hi @AMAK ,

If you have disabled NAT, then it should keep the client IP intact. Maybe you need to clear your firewall session for this change to take effect.

After that you can perform a packet capture from the FGT to confirm the change.

Please share below output from your Firewall.

diagnose sniffer packet any "host 192.168.1.54 or host <Public IP>" 4

Best Regards,

[AMAK]

I have replaced my Public IP with XXx and My mobile Data IP is 188.236.202.67.

 This is the sniffer log:

diagnose sniffer packet any "host 192.168.1.54 or host XX.XXX.XXX.XX" 4

FG-60F $ diagnose sniffer packet any "host 192.168.1.54 or host XX.XXX.XXX.XX" 4
interfaces=[any]
filters=[host 192.168.1.54 or host XX.XXX.XXX.XX]


132.757486 internal out 192.168.1.6.55531 -> 192.168.1.54.91: syn 1751848560
132.759381 internal in 192.168.1.54.91 -> 192.168.1.6.55531: syn 2721773468 ack 1751848561
132.937478 internal out 192.168.1.6.55531 -> 192.168.1.54.91: ack 2721773469
132.937500 internal out 192.168.1.6.55531 -> 192.168.1.54.91: psh 1751848561 ack 2721773469
133.122697 internal out 192.168.1.6.55531 -> 192.168.1.54.91: fin 1751848747 ack 2721776713
133.123310 internal in 192.168.1.54.91 -> 192.168.1.6.55531: fin 2721776713 ack 1751848748
133.968339 internal out 195.27.253.15.443 -> 192.168.1.54.55542: fin 2575636583 ack 4239391945
137.489526 internal out 192.168.1.6.45801 -> 192.168.1.54.84: syn 1789912502
137.491371 internal in 192.168.1.54.84 -> 192.168.1.6.45801: syn 3238154688 ack 1789912503
137.697419 internal out arp who-has 192.168.1.54 tell 192.168.1.6
137.697688 internal in arp reply 192.168.1.54 is-at 00:0c:29:a7:d6:8e
137.702817 internal out 192.168.1.6.45801 -> 192.168.1.54.84: ack 3238154689
142.192672 wan1 in 188.236.202.67.65347 -> XX.XXX.XXX.XX.80: syn 4121652317
142.192685 wan1 in 188.236.202.67.65346 -> XX.XXX.XXX.XX.80: syn 2218813157
142.192766 internal out 188.236.202.67.65347 -> 192.168.1.54.84: syn 4121652317
142.192767 internal out 188.236.202.67.65346 -> 192.168.1.54.84: syn 2218813157
142.194828 internal in 192.168.1.54.84 -> 188.236.202.67.65346: syn 1590208391 ack 2218813158
142.194863 wan1 out XX.XXX.XXX.XX.80 -> 188.236.202.67.65346: syn 1590208391 ack 2218813158
142.195583 internal in 192.168.1.54.84 -> 188.236.202.67.65347: syn 1358185383 ack 4121652318
142.195612 wan1 out XX.XXX.XXX.XX.80 -> 188.236.202.67.65347: syn 1358185383 ack 4121652318
142.261627 wan1 in 188.236.202.67.65347 -> XX.XXX.XXX.XX.80: ack 1358185384
142.261636 wan1 in 188.236.202.67.65346 -> XX.XXX.XXX.XX.80: ack 1590208392
142.261651 internal out 188.236.202.67.65347 -> 192.168.1.54.84: ack 1358185384
142.261659 internal out 188.236.202.67.65346 -> 192.168.1.54.84: ack 1590208392
144.305602 wan1 in 188.236.202.67.65346 -> XX.XXX.XXX.XX.80: fin 2218813158 ack 1590208392
144.305629 internal out 188.236.202.67.65346 -> 192.168.1.54.84: fin 2218813158 ack 1590208392
144.305830 internal out 188.236.202.67.65346 -> 192.168.1.54.84: fin 2218813158 ack 1590208392
144.306209 internal in 192.168.1.54.84 -> 188.236.202.67.65346: rst 1590208392 ack 2218813159
144.306229 wan1 out XX.XXX.XXX.XX.80 -> 188.236.202.67.65346: rst 1590208392 ack 2218813159
145.380360 wan1 in 188.236.202.67.65347 -> XX.XXX.XXX.XX.80: fin 4121653093 ack 1358840216
145.380400 internal out 188.236.202.67.65347 -> 192.168.1.54.84: fin 4121653093 ack 1358840216
145.380890 internal in 192.168.1.54.84 -> 188.236.202.67.65347: fin 1358840216 ack 4121653094
145.380910 wan1 out XX.XXX.XXX.XX.80 -> 188.236.202.67.65347: fin 1358840216 ack 4121653094

[saneeshpv_FTNT]

Hi @AMAK,

142.192672 wan1 in 188.236.202.67.65347 -> XX.XXX.XXX.XX.80: syn 4121652317
142.192685 wan1 in 188.236.202.67.65346 -> XX.XXX.XXX.XX.80: syn 2218813157
142.192766 internal out 188.236.202.67.65347 -> 192.168.1.54.84: syn 4121652317
142.192767 internal out 188.236.202.67.65346 -> 192.168.1.54.84: syn 2218813157

From the capture we could see that Fortigate is Forwarding your Client to your Internal IP 192.168.1.54 over the Internal interface and SYN ACK is coming back from 192.168.1.54 to 188.236.202.67. This means your WAF should be able to see this IP correctly unless you have any other device in between which is doing a double NAT on these traffic.

So please check the WAF again may be now its shows the right Client IP.

Best Regards,

[Mackenzie]

Configure the VIP to Preserve Client IP:

config firewall vip
 edit "IPS1-website"
     set extip XX.XXX.XXX.XX
     set mappedip "192.168.1.54"
     set extintf "any"
     set portforward enable
     set extport 80
     set mappedport 84
     set preserve-session-info enable
 next
end


Update Policy:
config firewall policy
 edit 2
     set srcintf "SD-WAN"
     set dstintf "internal"
     set action accept
     set srcaddr "all"
     set dstaddr "IPS1-website"
     set schedule "always"
     set service "ALL"
     set utm-status enable
     set ssl-ssh-profile "certificate-inspection"
     set av-profile "default"
     set webfilter-profile "default"
     set dnsfilter-profile "default"
     set file-filter-profile "default"
     set ips-sensor "default"
     set application-list "default"
     set logtraffic all
     set nat enable
 next
end

I hope you found help for this. By the way, here are the steps I followed at Coursepivot on how to disable the X-Real-IP header rewriting feature in Wordfence:

1. Go to Wordfence > Firewall.
2. Click on the Live Traffic tab.
3. Click on the Settings link.
4. Uncheck the Trust client IP X-Forwarded-For and X-Real-IP headers checkbox.
5. Click Save Settings.