# Wrong parsing of chained Proxy

**URL:** <https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457>\
**Category:** Search Guard\
**Created:** [August 30, 2023, 10:56am UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457 "2023-08-30T10:56:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\
**Post date:** [August 30, 2023, 10:56am UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457/1 "2023-08-30T10:56:03Z")

</div>

\*\*Elasticsearch version: 7.17.12

\*\*Server OS version: Rocky Linux release 8.8 (Green Obsidian)

\*\*Kibana version (if relevant): 7.17.12

\*\*Describe the issue:  
SG is unable to parse chained proxy

\*\*Steps to reproduce: Put an Apache server in front of a kibana server

\*\*Expected behavior: No error message

**Provide configuration:**  
elasticsearch/plugins/search-guard-7/sgconfig/sg\_config.yml  
The relevant section:

```auto
network:
  trusted_proxies: "10.x.x.x"
  http:
    remote_ip_header: "x-forwarded-for"

```

I see in Elastic logs:  
`org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [audit_rest_request_headers.x-forwarded-for] of type [ip] in document with id '40cSRooBAzpFVtZfD7e1'. Preview of field's value: '10.y.y.y,127.0.0.1'`

The first one (10.y.y.y) is the real one, the second is added by Apache, because it’s configured to use a proxy:

```auto
    <Proxy balancer://kibana>
        BalancerMember http://localhost:5601 responsefieldsize=65535
        BalancerMember http://localhost:5602 responsefieldsize=65535
        ProxySet lbmethod=bytraffic
    </Proxy>

```

A sequence of IP in `x-forwarded-for` is an expected behaviour, SG should not fails on it.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\
**Post date:** [September 1, 2023, 9:09am UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457/2 "2023-09-01T09:09:01Z")

</div>

@fbacchella I think this is because your Apache is terminating the TLS connection. That would change the value in x-forwarder-for.

---

<div class="post-metadata">

**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\
**Post date:** [September 4, 2023, 8:12am UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457/3 "2023-09-04T08:12:12Z")

</div>

I know, it’s expected: [X-Forwarded-For - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For). So it should not be a problem for SearchGuard, it throws a useless exception (and exception are not cheap in Java)

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [September 25, 2023, 8:12am UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457/4 "2023-09-25T08:12:55Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [November 9, 2023, 6:42pm UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457/5 "2023-11-09T18:42:12Z")

</div>



---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [November 9, 2023, 6:43pm UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457/6 "2023-11-09T18:43:33Z")

</div>

Some more questions:

- Are you using audit logging?
- If yes, are you logging to the local ES cluster, to a remote ES cluster or to somewhere else?
- Can you please post the whole stack trace of the exception you are getting?

---

<div class="post-metadata">

**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\
**Post date:** [November 10, 2023, 11:36am UTC](https://forum.search-guard.com/t/wrong-parsing-of-chained-proxy/2457/7 "2023-11-10T11:36:13Z")

</div>

You can close the topic. The problem was on my side.