# Prevent IP spoofing and identifying actual client ip **URL:** \ **Category:** General\ **Created:** [March 4, 2021, 2:20pm UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993 "2021-03-04T14:20:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Brane123](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/brane123/32/2608_2.png) [@Brane123](https://discuss.konghq.com/u/Brane123)\ **Post date:** [March 4, 2021, 2:20pm UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993/1 "2021-03-04T14:20:43Z")
I have a load balancer on top of Kong. LB is redirecting the traffic to one of the kong servers in the kong cluster. Kong forwards the request to Backend service Client → LB (L7 - AWS ALB) → Kong → Backend application [LB → Web server] At the webserver, the X-Forwarded-For header is used to identify the client’s IP to allow IP-based access. If the client sends X-Forwarded-For field in the request, it should not be honored. I need to drop the value in X-Forwarded-For header sent by the client and add the actual client IP in X-Forwarded-For. This is required to be done because anyone knowing allowed IPs should not have access to APIs. How can we do that? Actions taken: 1. I have tried the steps mentioned in the post - [How to Forward Client's request IP - #2 by thibaultcha](https://discuss.konghq.com/t/how-to-forward-clients-request-ip/384/2). It’s not working for me. a. Unset LB CIDR in trusted IPs (did not work) b. Set field real\_ip\_header = X-Forwarded-For (did not work) c. Set field real\_ip\_header = X-Real-IP (did not work) d. Set real\_ip\_recursive = on (did not work) 2. I have also tried to remove the X-Forwarded-For header in ngnix\_kong.lua template as mentioned in this post - [kong/nginx\_kong.lua at next · Kong/kong · GitHub](https://github.com/Kong/kong/blob/next/kong/templates/nginx_kong.lua#L141-L150) (Did not work) How can we remove X-Forwarded-For sent by a client in an API request and set the real client IP in the X-Forwarded-For header? This means I want to discard any pre-existing value in this field and add client IP (not LB IP, but client IP) Client → LB (L7 - AWS ALB) → Kong → Backend application [LB → Web server] ---
**Author:** ![Brane123](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/brane123/32/2608_2.png) [@Brane123](https://discuss.konghq.com/u/Brane123)\ **Post date:** [May 17, 2021, 10:20am UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993/2 "2021-05-17T10:20:43Z")
Can you please help with this? ---
**Author:** ![alion-wen](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alion-wen/32/2759_2.png) [@alion-wen](https://discuss.konghq.com/u/alion-wen)\ **Post date:** [May 31, 2021, 9:02am UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993/3 "2021-05-31T09:02:40Z")
kong service配置externalTrafficPolicy改为Local, 可以实现获取客户端正式IP ---
**Author:** ![Brane123](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/brane123/32/2608_2.png) [@Brane123](https://discuss.konghq.com/u/Brane123)\ **Post date:** [May 31, 2021, 9:24am UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993/4 "2021-05-31T09:24:05Z")
@alion-wen , I am able to get the client ip appended in the XFF header. I want to clear what is already received in the XFF header and send the real client IP to the upstream service, which I am unable to do. ---
**Author:** ![alion-wen](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alion-wen/32/2759_2.png) [@alion-wen](https://discuss.konghq.com/u/alion-wen)\ **Post date:** [May 31, 2021, 9:49am UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993/5 "2021-05-31T09:49:03Z")
Do you speak Chinese? We can communicate via email [ops\_gavin7@163.com](mailto:ops_gavin7@163.com) ---
**Author:** ![alion-wen](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alion-wen/32/2759_2.png) [@alion-wen](https://discuss.konghq.com/u/alion-wen)\ **Post date:** [May 31, 2021, 10:10am UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993/6 "2021-05-31T10:10:52Z")
I also have some questions for you about Kong ---
**Author:** ![Venky](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/venky/32/4194_2.png) [@Venky](https://discuss.konghq.com/u/Venky)\ **Post date:** [October 27, 2023, 11:49am UTC](https://discuss.konghq.com/t/prevent-ip-spoofing-and-identifying-actual-client-ip/7993/7 "2023-10-27T11:49:08Z")
I’m facing a similar issue , can you help with the resolution ?