Hi,
Can you send us the log (contact -at- nintechnet.com) so that we can test it? There could be a bug somewhere.
Simply add “BrianJM” and the link to this discussion to your email message.
It comes from the fact that you have 2 IPs recorded, rather than one:
1428572728] [0.00115] [your-domain.com] [#2083076] [0] [3] [95.128.246.44, 127.0.0.1] [403] [POST] [/wp-admin/admin-ajax.php] [File upload attempt] [revslider.zip, 19,182 bytes]
You can see that, in that hacking attempt coming from 95.128.246.44, it also shows the localhost IP 127.0.0.1.
Are you using the .htninja configuration file to modify the way the firewall should retrieve the users IP?
Yes, but only so that HTTP_X_FORWARDED_FOR is taken into account. Apache sits behind a Varnish cache server.
Here is the .htninja:
if ( isset($_SERVER[‘HTTP_X_FORWARDED_FOR’]) ) {
$_SERVER[“REMOTE_ADDR”] = $_SERVER[‘HTTP_X_FORWARDED_FOR’];
}
That’s what I thought.
The problem here is that it appends the localhost IP too.
You would either need to:
-Modify your server config so that it forwards only the client IP.
Or:
-Modify the .htninja script to use the first IP:
if ( isset($_SERVER['HTTP_X_FORWARDED_FOR']) ) {
$ips = @explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'], 2);
$_SERVER["REMOTE_ADDR"] = $ips[0];
}
Fair enough. Long story short, SSL requests have the localhost IP appended and standard requests do not (SSL termination is completed before Varnish).
I’ve seen NF block brute force attempts already. When it does this, and two IP addresses are provided, does NF use the combination of both IP addresses?
In the example below, what IP address is used here to block BF attempts? “89.97.141.237”, “89.97.141.237, 127.0.0.1”, or “127.0.0.1”?
[1428536217] [0.00142] [mydomain.com] [#6517592] [0] [3] [89.97.141.237, 127.0.0.1] [401] [POST] [/wp-login.php] [Brute-force attack detected on wp-login.php] [enabling HTTP authentication for XXmn]
The brute-force protection is not affected because it does not rely on IP.
I will made some change to the log, so that it will show all IPs. There is no reason not to show them, after all.
But I recommend you try to modify your .htninja as per my example, because WP and some of its plugins could have some problems to understand what is going on, if there is more that one IP.
I have done as you suggested. Thanks for the help!
