http_true_ip

The http_true_ip sticky buffer provides the original IP address of the client sending the request as it's stored by a proxy in the request message headers. Specifically, it is the last IP address listed in the "X-Forwarded-For" and "True-Client-IP" headers, or any other custom "X-Forwarded-For-type" header. If a request contains multiple headers of this type, then the preference defined in the xff_headers configuration variable is taken into account when determining which header value to include in this buffer.

Format:

http_true_ip;

Examples:

http_true_ip;
content:"192.168.1.2";

http_true_ip;
content:"150.172.238.178";