Skip to main content

Client IP Filtering in Weblogic and Apache through Load Balancer (F5 Big IP LTM)


Client IP Filtering in Web servers through Load Balancer


1  IP Web Filtration in Apache HTTP Web server
2  IP Web Filtration in Oracle Web Center  Suite on Windows Server 2003. 7
3  IP Web Filtration in Oracle Bea Weblogic on Linux




1       IP Web Filtration in Apache HTTP Web server

Following were the key steps used to configure filtration of client IP in access logs of apache HTTP server:

1.1.    Installing  Apache on Linux ( in our case its Ubuntu 10.10)
1.2.   Configuration of X-Forwarded-For in Apache configuration file
1.3.   Creating HTTP profile in Load balancer and enabling X-Forwarded-For
1.4.   Verifying the logs

1.1  – Installing  Apache on Linux ( in our case its Ubuntu 10.10)
#apt-get install apache2

1.2  Configuration of X-Forwarded-For in Apache configuration file
# nano /etc/apache2/apache2.conf
Now replace the %h variable with {X-Forwarded-For}i as shown below in apache2.conf file

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
1.3  Creating HTTP profile in Load balancer and enabling X-Forwarded-For
In our case the load balancer is F5 BIG-IP LTM 3600-4G. Following images will depict the process

1.1  Verifying the logs



# tail -f /var/log/apache2/access.log







2. IP Web Filtration in Oracle Web Center  Suite on Windows Server 2003


Following were the key steps used to configure filtration of client IP in access logs of apache HTTP server:

1.1.    Installing  Oracle Web Center  Suite on Windows Server 2003
1.2.   Configuration of X-Forwarded-For in Apache for web center suite configuration file
1.3.   Creating HTTP profile in Load balancer and enabling X-Forwarded-For
1.4.   Verifying logs

1.1 Installing  Oracle Web Center  Suite on Windows Server 2003
Please see the installation guide in oracle website
1.2 Configuration of X-Forwarded-For in Apache for web center suite configuration file
Oracle Web Center Suite server is used for hosting of company’s website (http://www.sngpl.com.pk). It works with apache as Http Server. So in order to monitor client ip in server logs for this environment, we had to update and configure Apache Http Server. Steps for updating and configuration of Apache are as follows
Step I: Update the required modules of Apache Http Server
For this purpose, following apache modules were required
·         mod_headers.so
·         mod_proxy.so
·         mod_proxy_connect.so
·         mod_proxy_http.so
Download these modules from Apache’s website (http://projects.apache.org/projects/http_server.html), and copy to modules directory in Apache Http Server.
Step II: Edit the configuration file (httpd.conf)
Open httpd.conf file in the conf directory of Apache Http Server, and add the following

AddModule mod_headers.c
AddModule mod_proxy.c
AddModule mod_proxy_http.c
AddModule mod_proxy_connect.c

# Log the originating ip if use a proxy
SetEnvIfNoCase X-Forwarded-For "." from_proxy=1

CustomLog C:\product\10.1.3.2.0\OracleAS_2\Apache\Apache\logs\apache2\without-proxy.log combined env=!from_proxy
CustomLog C:\product\10.1.3.2.0\OracleAS_2\Apache\Apache\logs\apache2\with-proxy-access.log      combined_forwarded env=from_proxy


Save the file and restart the server. Server log should now reflect the actual client IP instead of firewall IP.

1.3 Creating HTTP profile in Load balancer and enabling X-Forwarded-For
In our case the load balancer is F5 BIG-IP LTM 3600-4G. Following images will depict the process







1.1 Verifying the logs

C:\product\10.1.3.2.0\OracleAS_2\Apache\Apache\logs





3. IP Web Filtration in Oracle Bea Weblogic on Linux


1.1  Installing  Oracle Weblogic server  on linux

1.2  Enabling Weblogic Plugin
1.3  Creating HTTP profile in Load balancer and enabling WL-Proxy-Client-IP: [IP::client_addr]
1.4  Verifying logs

1.1            Installing Oracle Weblogic server  on linux (Ubuntu 10.10)
For configuration to be as closer as to the actual production environment, we setup weblogic on Linux on a VM machine. Following were the steps:
                   I.            Downloaded and installed Java 6 on Linux.
                II.            Setup PATH and JAVA_HOME environment variables for java.
             III.            Installing weblogic server with .jar installation package.
1.2  Enable Weblogic Plugin (see procedure and images below)
a.       Login to the weblogic admin console
b.      In the main panel  >> Domain Structure >>  wl_server >> Web Applications
c.       Check the check box with label “WebLogic Plugin Enabled ”
d.      Click Activate Changes, Save and Restart the server for changes to take effect.








1.3  Creating HTTP profile in Load balancer and enabling WL-Proxy-Client-IP: [IP::client_addr]




1.4  Verifying the logs

#cd /root/bea/wlserver_10.0/samples/domains/wl_server/servers/examplesServer/logs/
#tail -f access.log

Comments

  1. Thanks for putting this information on the internet. We were trying to get the client ip address in the access log using Weblogic and Radware appDirector hardware load balancing switch. Although not the same as the F5 Big-IP switch, the concept and implementation was the same. Using this information, now our access logs contain the correct client IP address.

    Cheers,
    John Hickey

    ReplyDelete

Post a Comment

Popular posts from this blog

Installing IBM Tivoli Storage Manager (TSM) Client (V 6.2.1) on Linux Ubuntu 32-bit (i386)

Installing IBM Tivoli Storage Manager (TSM) Client (V 6.2.1) on Linux Ubuntu 32-bit (i386) Step 1 Download the Installation files (in our case it is CZGL9MLtar.gz ) Step 2: We need to install an additional package for this version i.e., libstdc++5. This package contains an additional runtime library for C++ programs built with the GNU compiler. #apt-get install ksh libstdc++5 Step 3 Gunzip and tar the downloaded file. Make sure you have root privileges. root@ABCXYZ:~#pwd /root #chmod 777 CZGL9ML.tar.gz #gunzip CZGL9ML.tar.gz #tar -xvf /home/rizvi/CZGL9ML.tar #cd TSMCLI_LNX/tsmcli/linux86/ Here you would see rpm files. Step 4 Now we will unpack rpm files. For this we need alien package installed. If not then (#apt-get install alien) #alien –g TIVsm-API.i386.rpm #alien –g TIVsm-BA.i386.rpm #alien -g gskcrypt32-8.0.13.3.linux.x86.rpm   #alien -g gskssl32-8.0.13.3.linux.x86.rpm Step 5 Now we will change directory name. This is an

Neo4j: How to config the heap size and verify the setting

Setting Max_Heap_Size We can set the parameters of heap size in Neo4j graph database by changing "neo4j.conf" The default location of neo4j is   "/neo4j/conf/ " Simply remove # from the the following lines and set the size as you want. "m" represents Mega Bytes and "g" represents the Giga Bytes dbms.memory.heap.initial_size=512m dbms.memory.heap.max_size=2g Verify Max_Heap_Size Following is the command to verify the size  you set. $ CALL dbms.listConfig("heap"); The output will look like name description value dynamic "dbms.memory.heap.initial_size" "Initial heap size. By default it is calculated based on available system resources." "512m" false "dbms.memory.heap.max_size" "Maximum heap size. By default it is calculated based on available system resources." "4G" false