A10 X-forwarded-for Apr 2026

However, by inserting itself between the client and the server, an ADC creates a classic networking paradox:

Enter X-Forwarded-For (XFF). This article explores how A10 handles this critical header, how to configure it, and the security pitfalls that come with it. The X-Forwarded-For header is a de facto standard (defined in RFC 7239, though superseded by Forwarded ). Its syntax is a simple comma-separated list: a10 x-forwarded-for

When a client connects to an A10 VIP (Virtual IP), the A10 establishes a separate TCP connection to the backend server. From the server’s perspective, the source IP of every single packet is the A10’s own LAN IP—not the remote user. This breaks logging, geo-location, rate-limiting, and security rules. However, by inserting itself between the client and

When configured for L7 load balancing (HTTP mode), the A10 ADC rewrites the HTTP request headers before forwarding the packet to the real server. It typically appends the original client IP address to the existing XFF header. Its syntax is a simple comma-separated list: When

If your A10 is configured to append the client IP (the default), the header becomes: X-Forwarded-For: 127.0.0.1, 203.0.113.5

If a backend server receives requests from multiple clients over the same persistent connection from the A10, the XFF header will change per request . Your backend application code must be designed to parse the XFF header on every HTTP request, not just at the TCP connection establishment. Java HttpServletRequest.getRemoteAddr() will still return the A10’s IP; you must explicitly call getHeader("X-Forwarded-For") . Blindly trusting the first XFF value you see is a common and dangerous anti-pattern.

X-Forwarded-For: <client>, <proxy1>, <proxy2>