SFTPGo Community with AWS ALB, preserve client IP

[EjectSteve]

Scope is Web Client. Web client is behind AWS ALB that performs TLS. SFTPGo is serving http only.

I would like the actual client public IP to be logged by SFTPGo but only the ALB's private IP is being recorded right now. AWS ALB does not support any proxy modes and uses header X-Forwarded-For (Append) to preserve actual client public IP. SFTPGo doesn't appear to support this method unless you set proxymode = 1, but this understandably generates a Gateway error if turned on. Is there another way, or something I missed that would allow recording actual client IP from web users?

I have tried all ways below in httpd
"proxy_mode": 0, (1 causes gateway error. With 2, the server works but does not provide correct IP in logs)
"proxy_allowed": ["10.0.0.0/16"],
"client_ip_proxy_header": "X-Forwarded-For",
"client_ip_header_depth": 0, (tried 0, 1, 2)

[fostermi]

Unless your LB supports the PROXY protocol, proxy_mode should be left to 0 and it should probably only be used when using sftp and not HTTPS since that allows the addition of the PROXY TCP4 ... data in the packet or frame. For HTTPS the X-Forwarded-For header is what you want and if you're not getting the correct IP, then my guess is your proxy_allowed list is incorrect. I'd recommend using tcpdump to take a packet capture of the incoming HTTP requests are to see 1) what the actual source IP(s) are, and 2) if the X-Forwarded-For header is actually being set.

[EjectSteve]

Thanks for your reply. I believe have the internal IP's of the ALB correct and they are also the same IPs shown in the log fields named below
"ip"
"Remote Address"
"remote_addr"

config file httpd

    "proxy_mode": 0,
    "proxy_allowed": ["ALB-Internal IP","other-ALBinternal IP"],  (actual IPs removed for this forum)
    "client_ip_proxy_header": "X-Forwarded-For",
    "client_ip_header_depth": 1,

I am running on Windows so used wireshark and see these values. Also confirmed the ALB internal IPs with wireshark
X-Forwarded-For: my real public IP\r\n
X-Forwarded-Proto: https
X-Forwarded-Port: 443
my.domain.com\r\n

Looks like X-Forwarded-For with the correct client public IP is reaching the SFTPGo Server. I have also tried 0 and 2 for header_depth

[fostermi]

I think your header depth should be 0 not 1. Its read as an array from right to left with index starting at zero.

[EjectSteve]

This has worked, thank you.