Take the 2-minute tour ×


To allow the Zyxel USG 100's NAT to forward untouched packets to my web server i edited the policy route of the Zyxel.

Zyxel -> Configuration -> Network ->Routing -> Policy Route

I just edit the "Address Translation" option from "outgoing-interface" to "none"

Now apache is logging true external clients ip addresses


Good morning mates

today i'm facing a problem to correctly log clients request onto my corporate Apache2 web server

Network scheme:

////////////    _                      WAN1
| INTERNET /  _/  ===> CISCO Router =======> first public ip ==> to corporate LAN
                                  || zyxel eth0 ip:
                                  || label: WAN2
              ZYXEL ROUTER   ___ eth0 _________________________________________________
                             |   ZYXEL                                                |
                             |   Gateway
                             |    ||                                                  |
                             |    ||                                                  |
                             |   |\/| FIREWALL (accept request from eth0/WAN2 on port |                  
                             |    ||            443/80 and forward them to LAN1)      |
                             |    ||                                                  |
                             |   |\/| NAT (forward request on to       |
                             |    ||        web server on            |
                                  *zyxel eth1 ip:, label: lan1*
                                   |                    \   mysqlserver
                           ________|                    ++
  webserver  / 

When someone (from Internet or my private lan) request a page to my public ip on port 80, my webserver respond to it correctly. But when i want to check access.log of my web server i can see only my Zyxel router ip logged.

I suppose there is a NAT problem, it seems that the Zyxel subsitutes its ip address as SRC of IP packets coming to my webserver.

What i have to do to get a properly logged web requests with public clients ip addresses? Router is the Zyxel USG 100

this is my Apache2 log configurations (apache2.log)

LogFormat "%{User-agent}i" agent

this is my vhost log configuration

CustomLog /var/log/apache2/xyz.com/access.log combined


share|improve this question
Rather than putting the answer in the question it's OK to self-answer once you have an answer. –  tombull89 Jan 13 at 14:57
ok, thank you. Should i report here the solution? –  mrbang0day Jan 13 at 16:08
Yes, please. New users might have to wait a bit before answering their own question, but it's better if you post the answer as...well, an answer. –  tombull89 Jan 13 at 20:52

1 Answer 1

%{X-ClientSide}i may be what you want to add to your logformat to get the remote address of the client.

share|improve this answer
Thank you for your 2cents but as i expected it was a Nat/Firewall or Routing problem. –  mrbang0day Jan 13 at 14:37

Your Answer


