> Source: [sk184753](https://support.checkpoint.com/results/sk/sk184753)

# sk184753 - How to Forward Client's Real IP to Upstream Server via WAF

| Property | Value |
|----------|-------|
| Solution ID | sk184753 |
| Date Created | 2026-06-14 |
| Last Modified | 2026-06-16 |
| Technical Level | General |
| Products | WAF Application Security |
| Versions | Cloud |

## Symptoms

- The upstream server sees only the WAF's NAT IP address for all traffic.

## Cause

By design, the upstream server sees only the NAT IP address of the WAF. However, in certain environments, customers may need the upstream server to identify the client's real IP address, which can be passed using the X-Forwarded-For (XFF) header.

## Solution

Configure custom headers in the WAF policy to forward the client's real IP address to the upstream server.  
**Procedure**   

1. Log in to [Check Point Portal](https://portal.checkpoint.com/).
2. Access the WAF Application Security Cloud Portal.
3. Go to **Policy.**
4. Go to **Assets**and select the relevant asset.
5. Go to **Reverse Proxy Advanced**.
6. Enable **Add custom headers**.
7. Add the following headers:  
   * **Key** : X-REAL-IP  
     **Value**: $remote_addr
   * **Key** : X-FORWARDED-FOR  
     **Value** : $proxy_add_x_forwarded_for   
     ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1772032692796/RealIP_Header202602251025281.png)
8. Click **OK**.
9. Enforce the policy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content