How can the client IP address be obtained in MOVEit Transfer environments where a load balancer or a reverse proxy is implemented?

A common issue with Load Balancers (F5 is referenced specifically below) is that the IP address of the load balancer is logged as the Client IP instead of the actual Client IP. This causes remote access rules to not function correctly and IP Lockouts to lock out every user. 
Please note: Configuration of your F5 Load Balancer and URL Rewrite are beyond the MOVEit Scope of Support (https://www.progress.com/support/moveit-scope-of-support).  The Progress support team will not be able to offer any assistance with this procedure beyond providing this guide.
 
Sometimes different WAF solutions will not send the true client IP, but send it within a header. As long as the WAF server is configured to be a Trusted Host in MOVEit, then it should accept the client IP via the X-Forwarded-For header. 

This presents in a few different ways. It may deny access on all interfaces or it may work on web portal, but present an access denied to FTP/SFTP clients.

 

1. Log in as the sysadmin user
2. Navigate to Settings > System > Remote Access > SysAdmin & Trusted Hosts
3. Under Trusted Hosts (for System organization only), click Edit Access Rules
   • Related documentation on these settings is located in this section of the MOVEit Transfer Administrator Guide: System - Remote Access - https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2025/page/System-Remote-Access.html

To mark the Load balancer IP address as a Trusted Host on the Org Level :

1.Login as an Org admin

2.Navigate to Settings>Security Policies>Remote Access>Default Rules

3.Under "Trusted Hosts" , click "Edit Access Rules" , next click on "Add Remote Access Rule" 

4.Type the LB IP address provide a comment if needed then click on the " Add Entry" button to save the changes

 

 

These methods are technically workarounds for this process because these options are only available with applications outside of the scope of MOVEit products. The information presented below is a summary of what the MOVEit Support team has found effective for other customers connecting over HTTP/s through a load balancer. 

If using MOVEit Gateway:

• As of Gateway 2018 and later, the X-Forwarded-For request field will be handled. This will enable an associated MOVEit Transfer Server to distinguish between the originating client’s IP address and the IP from your firewall/load balancer/proxy.

• When using URL Rewrite or similar applications with Progress (formally Ipswitch) products, always ensure that the X-Forwarded-For request field is sanitized on incoming HTTP requests (preferably from a trusted point in your network). Otherwise, URL Rewrite, Progress Gateway, or similar could be passed a malformed or bogus IP address.  Sanitize this field at a trusted device such as the firewall/load balancer/proxy by configuring it to overwrite with <originating-client’s-IP>,<proxy1-IP>

  • Where <originating-client’s-IP> is the client that initiated the TCP connection.

  • And, where <proxy1-IP> is the trusted device.

• In the Gateway Management interface, under Settings, list the load balancer's IP as the Trusted Host IP.  This should always be whichever device is sending the forwarded IP to the Gateway server.

Sample F5 Load Balancer Setup
 
The below setup/configuration is technically outside of the Transfer Product/Support and is simply a method that has been found to resolve the issue of Transfer only logging the F5 IP. There is a similar issue seen with IIS logging (see the "IIS Logging of Client IP" topic at the bottom of this section). 


The steps to configure URL Rewrite to alter the REMOTE_ADDR value for ONLY the traffic originating from the F5 (will need to be done on all Transfer Nodes) are as follows:

(Note the below is an example and my differ on different F5's you may need to verify with the vendor)

MOVEit Transfer Logging of Client IP
 
Download and install URL Rewrite on each Transfer Node: http://www.iis.net/downloads/microsoft/url-rewrite
 
In IIS Manager, go to the Server level (NOT the MOVEit Transfer website as that would result in the configuration being written to the Transfer Web.config which could be overwritten during updates) and double click URL Rewrite in Features.
 
Select Add Rule(s)... from the Action pane on the right.
 
Select Blank Rule.
 
Name the Rule whatever you like (I chose "Rewrite REMOTE_ADDR with X-Forwarded-For from F5").
 
Match URL section:
       - Requested URL: Matches the Pattern
       - Using: Regular Expressions
       - Pattern: .*
       - Ignore case: checked

An alternative way to configure the Match URL section if the first way is not working:

       - Requested URL: Matches the Pattern
       - Using: Wildcards
       - Pattern: *
       - Ignore case: checked
 
Conditions section:         <-- This is where we tell URL Rewrite which requests to alter. There will be 3 conditions.
        - Logical Grouping: MATCH ALL
        - Select Add...
                    - Condition input: {HTTP_HOST}
                    - Check if input string: Matches the Pattern
                    - Pattern: insert ^ plus the Host portion for the URL. (^testdmz.company.com, for example)    <-- This is so the rule only applies to requests headed for Transfer in case there are other websites hosted in IIS on this server.

 
        - Select Add...
                    - Condition input: {REMOTE_ADDR}
                    - Check if input string: Matches the Pattern
                    - Pattern: insert the IP address of the proxy  <-- This is so the rule only applies to traffic originating from the F5 in order to not overwrite the REMOTE_ADDR value for other traffic (internal, etc).
                    - Ignore Case: checked
                    - OK

 
        - Select Add...
                    - Condition input: {HTTP_X_FORWARDED_FOR}
                    - Check if input string: Matches the Pattern
                    - Pattern: *.*.*.*   <-- This is an extra check so the only requests altered are those that originated from the F5 (the second Condition above) AND those that include an IP address in X-Forwarded-For on the off chance some traffic may come from your F5 without an IP address (better safe than sorry!). The pattern input may use wildcard *s to designate the configuration. 
                     - Ignore case: checked
                     - OK

                               
 Server Variables Section:  <-- This is where the changing of the REMOTE_ADDR value.
         - Select Add...
                  - Server variable name: REMOTE_ADDR
                  - Value: {HTTP_X_Forwarded_For}
                  - Replace the existing value: checked
                  - OK

               
   Action section:
          - Change Action type to NONE
               
Apply rule by selecting Apply Rule on the top right in the Actions pane. The new Rule goes into effect immediately.
               
Select Back to Rules in the Action pane if desired. Note on the main URL Rewrite screen, with the Rule selected, it is possible to Disable the Rule if desired.
               
At this point, any traffic coming from the F5 (the IP configured in the second Condition) that also has an X-Forwarded-For value will have the REMOTE_ADDR rewritten and Transfer should see the Client IP address.
               
  
 
IIS Logging of Client IP
 
The above change allows Transfer to log the real Client IP. IIS, on the other hand, will still log the IP of the F5. There are numerous articles referenced online on how to overcome the “out of the box” limitation of IIS to log the value in X_FORWARDED_FOR. The solution deploy is a matter of choice, assuming the goal is to have IIS log the correct IP. To be clear, this is strictly a limitation with IIS receiving requests from load balancers and the information below is in no way related to nor will have any effect on Transfer.
 
This article does a good job in describing the three most common methods to overcome the IIS limitation:
http://blogs.iis.net/deanc/archive/2013/07/08/iis7-8-logging-the-real-client-ip-in-the-iis-hit-logs.aspx

References to Other Documentation:
In version 2018 SP1 (10.1), the X-Forwarded-For header started being supported, which makes the URL Rewrite unnecessary as long as the Load Balancer is sending that header and is trusted. There is a note about this change in the MOVEit Transfer 2018 (SP1) Release Notes > Fixed Issues in 2018 SP1: https://docs.ipswitch.com/MOVEit/Transfer2018SP1/ReleaseNotes/en/index.htm#43616.htm  

Progress article(s):
How to whitelist an IP Address in MOVEit Transfer