The question mod_security with OWASP CRS: Custom rule for whitelisting googlebot provides the following rule as the answer to verify the client's hostname:
SecRule REMOTE_HOST “@rx google(bot|)\.com$” “id:50000,nolog,allow”
This rule was meant to be used on ModSecurity with Apache and required the directive HostnameLookups On
configured on Apache. The MODSECURITY HANDBOOK says:
REMOTE_HOST
If the Apache directive HostnameLookups is set to On, then this variable will hold the remote hostname resolved through DNS. If the directive is set to Off, this variable will hold the remote IP address (same as REMOTE_ADDR). Possible uses for this variable include denying known bad client hosts or network blocks or, conversely, allowing authorized hosts in.
When using Nginx as reverse proxy without Apache is there a way to make REMOTE_HOST
return the hostname resolved through DNS?