Local IP Address recorded in web application behind Azure application gateway

Hi @FPI Erick Aspiras(Erick Aspiras)

When a web app is behind Azure Application Gateway, the client's public IP is not directly visible — instead, it shows the gateway's IP.

To capture the real client IP, use the X-Forwarded-For header. Tomcat can be configured to log this by updating the AccessLogValve in server.xml, or your application can read it manually using request.getHeader("X-Forwarded-For").

You can configure X-Forwarded-For to pass the original client IP to the backend.

One you rewrite rule and associate this rewrite set with your routing rule.

Once done the above seetings, On your backend (e.g., Tomcat, NGINX, etc.), check logs or capture the value of X-Forwarded-For to verify that it contains the client’s public IP.

I hope this helps to resolve your issue.

If the above is unclear and/or you are unsure about something, add a comment below.

Hi @FPI Erick Aspiras(Erick Aspiras)

I just wanted to follow up and see if you had a chance to review my answer to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hello Venkat,

Thanks. I'm just now reviewing your post. Pls give me time. I will check and revert as soon as possible. BTW, how can I check the gateway's IP Address? When I check my gateway it does not display any internal IP Address.

Hi @FPI Erick Aspiras(Erick Aspiras)

You can see the public IP address listed under "Frontend public IP address" in your screenshot. This is the IP used for internet-facing access when public listeners are configured.

Since the private IP address is blank, it means the Application Gateway was not configured with a private frontend IP and is currently using only public listeners. If you need internal access, you can add a private IP via the "Frontend IP configurations" section.

Thanks. I understand the public ip address. If you look at the app log below, its recording internal IP Address 10.1.3.26 and 10.1.3.4 but those are not the IP Addresses of the backend/listener servers.