How to get client IP in NATing mode

A website is deployed in house, and network admin routed the network through NGAF which maps public IP (e.g. 200.x.x.x ) to local IP (e.g. 10.x.x.x).
Now the website is assailable by public IP and domain name assigned to it but the problem is that I am not able to get real client IP, it always shows me the Network's/Firewall's public IP no matter from where the user access the website. Is there any simple solution to it? If you need anything for more clearity I will ask the network admin.

Yes, there's a common solution for this. The NGAF (Next Generation Application Firewall) is likely performing Network Address Translation (NAT), which hides the client's real IP address.

Here's a simple solution:

Ask your network admin to configure the NGAF to insert the client's real IP address into the `X-Forwarded-For` HTTP header. Most web servers and web application frameworks can then be configured to read the client's IP from this header.

If the NGAF can't add the `X-Forwarded-For` header, another option is the `Proxy Protocol`. Your network admin would need to enable Proxy Protocol on the NGAF, and your web server would need to be configured to understand it. However, `X-Forwarded-For` is generally simpler to configure.

Hi
Indeed, there is a shared answer to this problem.  Network Address Translation (NAT), which conceals the client's actual IP address, is probably being carried out by the Next Generation Application Firewall (NGAF).  Here's a straightforward fix:  Request that the NGAF be set up to add the client's actual IP address to the `X-Forwarded-For` HTTP header.  The client's IP address can then be read from this header by the majority of web servers and web application frameworks.  The `Proxy Protocol` is an additional choice if the NGAF is unable to add the `X-Forwarded-For` header.  Proxy Protocol must be enabled on the NGAF by your network administrator, and your web server must be set up to support it.  In general, though, `X-Forwarded-For` is easier to set up.

Yes, this issue is caused by Source NAT (SNAT) or Full NAT on the Sangfor NGAF which masks the original client IP with the firewall's public IP during traffic forwarding. Your web server always sees the NGAF's IP instead of the real client's.

Sangfor NGAF supports inserting the real client IP address into the X-Forwarded-For HTTP header when NAT is used. Your web server can then extract the client IP from this header.

On NGAF: Enable X-Forwarded-For Header Insertion

Web Application Protection > HTTP Policy or
Server Protection > HTTP Protection Settings

Enable the “Insert X-Forwarded-For Header” option.

Save and apply changes.