3

apache httpd.conf

LoadModule geoip_module modules/mod_geoip.so
<IfModule mod_geoip.c>
    GeoIPEnable On
    GeoIPEnableUTF8 On
    GeoIPOutput Env
    GeoIPScanProxyHeaders On
    GeoIPDBFile /usr/share/GeoIP/GeoIP.dat IndexCache
</IfModule>

HTTP Request:

GET /test.php HTTP/1.1
Host: XXXXXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
X-Forwarded-For: 150.XX.XX.XXX

test page /test.php

<?php

if( isset($_SERVER['GEOIP_COUNTRY_CODE']) ){
    echo 'GEOIP_COUNTRY_CODE: '.$_SERVER['GEOIP_COUNTRY_CODE'].'<br>';
}

if( isset($_SERVER['GEOIP_COUNTRY_NAME']) ){
    echo 'GEOIP_COUNTRY_NAME: '.$_SERVER['GEOIP_COUNTRY_NAME'].'<br>';
}

if( isset($_SERVER['GEOIP_ADDR']) ){
    echo 'GEOIP_ADDR: '.$_SERVER['GEOIP_ADDR'].'<br>';
}

if( isset($_SERVER['HTTP_X_FORWARDED_FOR']) ){
    echo 'HTTP_X_FORWARDED_FOR: '.$_SERVER['HTTP_X_FORWARDED_FOR'].'<br>';
}

echo 'REMOTE_ADDR: '.$_SERVER['REMOTE_ADDR'].'<br>';

Output 

GEOIP_COUNTRY_CODE: IT
GEOIP_COUNTRY_NAME: Italy
GEOIP_ADDR: 66.XX.XX.XXX
HTTP_X_FORWARDED_FOR: 150.XX.XX.XXX
REMOTE_ADDR: 66.XX.XX.XXX

expected

GEOIP_COUNTRY_CODE: US
GEOIP_COUNTRY_NAME: United States
GEOIP_ADDR: 150.XX.XX.XXX
HTTP_X_FORWARDED_FOR: 150.XX.XX.XXX
REMOTE_ADDR: 66.XX.XX.XXX

mod_geoip seems to not use HTTP_X_FORWARDED_FOR ipaddress... why?

Server version: Apache/2.4.18 (Unix) Server built:   Feb  4 2016 17:41:16
Loaded Modules:
 core_module (static)
 so_module (static)
 http_module (static)
 authn_file_module (shared)
 authn_core_module (shared)
 authz_host_module (shared)
 authz_groupfile_module (shared)
 authz_user_module (shared)
 authz_core_module (shared)
 access_compat_module (shared)
 auth_basic_module (shared)
 socache_shmcb_module (shared)
 reqtimeout_module (shared)
 filter_module (shared)
 substitute_module (shared)
 deflate_module (shared)
 mime_module (shared)
 log_config_module (shared)
 env_module (shared)
 expires_module (shared)
 headers_module (shared)
 setenvif_module (shared)
 version_module (shared)
 proxy_module (shared)
 proxy_connect_module (shared)
 proxy_ftp_module (shared)
 proxy_http_module (shared)
 proxy_fcgi_module (shared)
 proxy_scgi_module (shared)
 proxy_wstunnel_module (shared)
 proxy_ajp_module (shared)
 proxy_balancer_module (shared)
 proxy_express_module (shared)
 slotmem_shm_module (shared)
 lbmethod_byrequests_module (shared)
 lbmethod_bytraffic_module (shared)
 lbmethod_bybusyness_module (shared)
 lbmethod_heartbeat_module (shared)
 mpm_event_module (shared)
 unixd_module (shared)
 status_module (shared)
 autoindex_module (shared)
 negotiation_module (shared)
 dir_module (shared)
 actions_module (shared)
 alias_module (shared)
 rewrite_module (shared)
 geoip_module (shared)

I suspect that the version of my geoip is old

$ dpkg -l | grep apache

maybe it is 

ii  libapache2-mod-geoip   1.2.8-2  amd64        
    GeoIP support for apache2
ar099968
  • 485
  • 1
  • 3
  • 11
  • 1
    You might want to print the full headers, to check if maybe one of the [headers that have precedence](http://dev.maxmind.com/geoip/legacy/mod_geoip2/#Proxy-Related_Directives) above the `X-Forwarded-For` header have been set, i.e. is `HTTP_CLIENT_IP` or `HTTP_X_FORWARDED_FOR` set? – HBruijn May 12 '16 at 12:29
  • @HBruijn only HTTP_X_FORWARDED_FOR is set... – ar099968 May 12 '16 at 13:18
  • 1
    Are you using the `mod_remoteip` module as well as `mod_geoip`? Also, what about trying `GeoIPScanProxyHeaderField X-Forwarded-For`? – Castaglia May 12 '16 at 18:24
  • @Castaglia `mod_remoteip` is disabled. If try to add `GeoIPScanProxyHeaderField X-Forwarded-For` apache raise exception `Invalid command 'GeoIPScanProxyHeaderField', perhaps misspelled or defined by a module not included in the server configuration` – ar099968 May 13 '16 at 06:50
  • 2
    Interesting. Looks like the mentioned `GeoIPScanProxyHeaderField` directive was added in version [1.2.9](https://github.com/maxmind/geoip-api-mod_geoip2/releases/tag/1.2.9) of `mod_geoip`. Can you upgrade your module version? – Castaglia May 13 '16 at 17:48
  • @Castaglia i can upgrade, but i don't know how do... I'm newbie on linux... – ar099968 May 16 '16 at 07:25

0 Answers0