How to get clients IP address when using a load balancer
To get a client's IP address, use the X-Forwarded-For header for Application Load Balancers (Layer 7) or enable Proxy Protocol v2 for Network Load Balancers when client IP preservation is not possible by default [citation:4][citation:8].
The method for retrieving a client's IP address depends on the type of load balancer [citation:4][citation:8]:
- 1
Application Load Balancer (ALB): The ALB preserves the original client IP by injecting an
X-Forwarded-ForHTTP header. Your application should be configured to read this header to obtain the client's IP address. - 2
Network Load Balancer (NLB): By default, the NLB preserves the client IP address when targets are registered by instance ID within the same VPC. For remote targets (e.g., on-premises), PrivateLink, or hairpinning, you must enable Proxy Protocol v2 on the target group and configure your application to parse the proxy protocol header [citation:8].
- 3
Classic Load Balancer (CLB): Similar to ALB, CLB uses the
X-Forwarded-Forheader. It also supports Proxy Protocol as an option.
Scenario Questions
0-2 years experience
- 1You have an EC2 instance behind an Application Load Balancer. How would you retrieve the original client IP inside your web application?
- 2Your logs are showing 10.0.0.5 as the request source. What could cause that and how would you correct it?
2-5 years experience
- 1After switching from a Classic ELB to an ALB, your service started logging the load balancer's IP instead of the client IP. Walk me through how you'd debug and fix the issue.
- 2Explain the trade‑offs between relying on the X‑Forwarded‑For header versus enabling Proxy Protocol on the load balancer.
5-8 years experience
- 1Design a logging pipeline that reliably captures the true client IP for requests that traverse multiple AWS load balancers, NAT gateways, and VPC endpoints at high scale.
- 2How would you ensure the client IP remains accurate when you have a mix of HTTP and TCP listeners behind the same load balancer?
8+ years experience
- 1Your organization is migrating from a monolith behind a Classic ELB to a microservices architecture using several ALBs and API Gateway. How would you standardize client IP capture across all services while minimizing code changes and operational risk?
- 2Discuss the long‑term maintenance implications of depending on X‑Forwarded‑For versus Proxy Protocol in a multi‑region, multi‑account deployment.
Follow-up Questions
- What security risks exist if you blindly trust X-Forwarded-For?
- How does the load balancer handle IPv6 addresses in these headers?
- When might you still see the load balancer's IP despite proper configuration?