A10 X-forwarded-for Apr 2026

If your A10 is configured to append the client IP (the default), the header becomes: X-Forwarded-For: 127.0.0.1, 203.0.113.5

If your backend server reads only the first IP (leftmost) as the client, it will believe the request is coming from 127.0.0.1 (localhost)—bypassing all ACLs.

However, by inserting itself between the client and the server, an ADC creates a classic networking paradox: a10 x-forwarded-for

If a backend server receives requests from multiple clients over the same persistent connection from the A10, the XFF header will change per request . Your backend application code must be designed to parse the XFF header on every HTTP request, not just at the TCP connection establishment. Java HttpServletRequest.getRemoteAddr() will still return the A10’s IP; you must explicitly call getHeader("X-Forwarded-For") . Blindly trusting the first XFF value you see is a common and dangerous anti-pattern.

When a client connects to an A10 VIP (Virtual IP), the A10 establishes a separate TCP connection to the backend server. From the server’s perspective, the source IP of every single packet is the A10’s own LAN IP—not the remote user. This breaks logging, geo-location, rate-limiting, and security rules. If your A10 is configured to append the

A malicious client sends an HTTP request directly to your A10 with a forged header: GET /admin HTTP/1.1 X-Forwarded-For: 127.0.0.1

A10 provides a configuration option to prevent this. Instead of appending, you can configure the ADC to or replace the XFF header. Java HttpServletRequest

In the CLI:

In the modern data center, the Application Delivery Controller (ADC) sits as the gatekeeper. A10 Networks’ Thunder series is a market leader in this space, performing tasks from server load balancing (SLB) and SSL offload to advanced L7 inspection.

X-Forwarded-For: <client>, <proxy1>, <proxy2>