Akamai CDN with Wordfence

Hi Sarah,

Just to confirm, in the Wordfence settings, have you already set “How does Wordfence get IPs” to the option that says “X-Real-IP”?

When Akamai support said “We are currently sending True-Client-IP header, you can name it X-Real-IP” — did they give instructions on how to rename it? It sounds like something in your Akamai settings that would need to be changed.

While testing this, to prevent any unintentional blocking, you can temporarily turn off the “Enable firewall” option at the top of the Wordfence options page, and you can see which IP addresses are coming through by viewing the Live Traffic page. (If you visit the site in a second browser where you are not logged in, you should see your own IP address in the Live Traffic.) Once you’re sure the IP addresses are coming in correctly, you can then re-enable the firewall.

-Matt R

Hi Matt,

Yes, you are correctly describing how we configured the settings on Wordfence and on Akamai. Here is a link to screenshots of the settings in case that will give you more information: https://docs.google.com/drawings/d/1eLLd8R22F7y9bUY8JJ5oEDf3gYj050MAYQlA5LB_Tu0/edit?usp=sharing

We also disabled the firewall, and used the Live Traffic as you describe, to test. Even so, all of the Live traffic IP addresses were owned by Akamai. I did not see my own IP address or the address of the other admins, even though I know they were on the site at that time.
Anything else that we could try, or do you see a mistake in the settings?
Thanks
Sarah

Hi Sarah,

Just in case it’s a problem with the cached config, can you turn on “Disable config caching” near the bottom of the Wordfence options page, and see if new visits appear correctly after that?

I haven’t used Akamai before, but the settings do seem to be ok.

The only other thing I can think to check, is to see if you can find the headers manually — near the bottom of the Wordfence options page, you can click the link that says “Click to view your system’s configuration in a new window”. At the bottom of that page should be the actual headers, so you can see if x-real-ip appears, and if it shows your own IP. (If the header appears there with the right IP, it would narrow it down to your site — Wordfence or a conflict with another plugin.)

We’ve found recently that this feature doesn’t work on certain PHP versions, so if you don’t see a long page with headers, we may need to find another method to check this.

As an aside, you might also want to check with Akamai on the meaning of the “Allow clients to set true client IP header” — to me, that sounds like if the client (the end user) sets that header, Akamai will forward what they sent, which could lead to IP spoofing.

-Matt R