Original Client in Network Conditions (Filtering Proxied Traffic)
For some rules, you can handle proxied traffic based on the originating client. Use a source network condition to specify proxy servers, then add an original client constraint to specify original client IP addresses. The system uses a packet's X-Forwarded-For (XFF), True-Client-IP, or custom-defined HTTP header field to determine original client IP.
Traffic matches the rule if the proxy's IP address matches the rule's source network constraint, and the original client's IP address matches the rule's original client constraint. For example, to allow traffic from a specific original client address, but only if it uses a specific proxy, create three access control rules:
Access Control Rule 1: Blocks proxied traffic from a specific IP address (209.165.201.1)
- Source Networks: 209.165.201.1
- Original Client Networks: none/any
- Action: Block
Access Control Rule 2: Allows proxied traffic from the same IP address, but only if the proxy server for that traffic is one you choose (209.165.200.225 or 209.165.200.238)
- Source Networks: 209.165.200.225 and 209.165.200.238
- Original Client Networks: 209.165.201.1
- Action: Allow
Access Control Rule 3: Blocks proxied traffic from the same IP address if it uses any other proxy server.
- Source Networks: any
- Original Client Networks: 209.165.201.1
- Action: Block