Mediawiki behind reverse proxy populates user IP address with proxy address

apache-2.2mediawikireverse-proxy

I have apache running on a fw machine that reverse proxies different folders to different back end servers, and also wraps the connection in SSL. …a fairly common setup.

Predictably, the backend mediawiki instance believes all access is coming from 1 IP, that of the reverse proxy. Since it's a significant part of mediawiki functionality that is lost, is it possible to pass the correct IP address for mediawiki to reference and use for user management and logging i.e. IP assertion? HTTP headers would make sense.

Best Answer

Absolutely.

If you are using mod_proxy_http, Apache is likely already sending the real IP in the X-Forwarded-For headers.

It looks like MediaWiki supports this out of the box by enabling a variable in your configuration:

$wgUsePrivateIPs = true;
$wgSquidServers = array( 'proxy fqdn', 'proxy ip address' );

More info: https://www.mediawiki.org/wiki/Manual:$wgUsePrivateIPs

Enabling this will tell MediaWiki to read the client IP from X-Forwarded-For headers.