# Winfrasoft > Winfrasoft builds commercially supported infrastructure security and authentication software for enterprise IT teams, government departments and the NHS, solving gaps that platform vendors leave open. Founded 2005, customer base across twenty-seven countries. Winfrasoft's current focus is X-Forwarded-For for IIS, which restores the real visitor IP address in Microsoft IIS logs when IIS sits behind a reverse proxy, load balancer or CDN. Earlier products (2005–2023) covered Microsoft Forefront TMG/ISA Server security add-ons and PINgrid pattern-based multi-factor authentication, which was spun out as Authlogics and acquired in 2023. ## Products - [X-Forwarded-For for IIS](https://winfrasoft.com/products/x-forwarded-for/): Commercially supported ISAPI web filter for IIS 10 on Windows Server 2016–2025. Reads the X-Forwarded-For HTTP header and writes the real client IP directly into the standard IIS c-ip log field, with Proxy Trust List anti-spoofing against header forgery. No application changes required; existing SIEM, log analysis and compliance tooling keeps working unchanged. Per-server perpetual licensing from £395 / $495, 14-day evaluation available. - [Request a download](https://winfrasoft.com/download/): Request the installer and a 14-day evaluation licence for X-Forwarded-For for IIS. ## Guides - [Which client IP header does your proxy send?](https://winfrasoft.com/kb/proxy-client-ip-headers/): Reference table of the client IP headers set by Cloudflare, AWS, Azure, F5, ARR, Nginx, HAProxy, Akamai and Fastly, how the X-Forwarded-For chain is ordered, and why the chain must be validated from the right against a trust list. - [X-Forwarded-For and IIS](https://winfrasoft.com/kb/x-forwarded-for-iis/): What the X-Forwarded-For header contains and why the leftmost address is caller-controlled and must not be trusted; that no version of IIS, including IIS 10, reads the header natively, unlike Apache mod_remoteip or nginx real_ip; the three distinct problems people mean by this question (the IIS c-ip log field, the application's view of the client address, and a proxy not sending the header); and what the IIS 8.5 custom log field does and does not solve. - [How to log X-Forwarded-For in IIS](https://winfrasoft.com/kb/iis-c-ip-log-field/): Adding an X-Forwarded-For column to IIS logs on IIS 8.5 and later (site-level only; with the server selected in IIS Manager the Add Field control is disabled) and server-wide with PowerShell, plus why the Advanced Logging route for IIS 7 to 8 is closed now that Microsoft has discontinued the extension. Note that enabling custom fields makes IIS write log files with _x appended to the filename, which can silently break a collector matching the old pattern. Also what the c-ip field records, how to read the #Fields line, why a reverse proxy makes every log line show the same address, and why the custom column does not correct c-ip. - [IIS custom field for X-Forwarded-For not working](https://winfrasoft.com/kb/iis-custom-field-x-forwarded-for-not-working/): Troubleshooting an IIS Enhanced Logging custom field that shows no column, an empty column or a dash on every row. The eight causes: IIS starts writing a separate log file with _x appended to the name and the data is only in that file; Add Field is disabled because the server rather than a site is selected, and enhanced logging is site-level only; the header is not reaching IIS at all; the Source string does not match the Source Type, in particular that Request Header takes X-Forwarded-For while Server Variable takes HTTP_X_FORWARDED_FOR in upper case only, because Microsoft documents that enhanced logging cannot log a server variable whose name contains lower-case characters; the log format is not W3C; HTTP.sys buffers log writes for about 60 seconds so netsh http flush logbuffer is needed to see them immediately; IIS is older than 8.5, where Enhanced Logging was introduced; and Apply was never clicked. Also why a working custom field still leaves c-ip showing the proxy, and how a multi-proxy chain appears in the column. - [Real client IP in IIS behind Barracuda](https://winfrasoft.com/kb/iis-real-client-ip-behind-barracuda/): The Barracuda Web Application Firewall and Load Balancer ADC insert X-Forwarded-For by default in proxy mode, while Layer 4 TCP and UDP services pass the client IP in the TCP header and need no change at all. Barracuda's two documented options, Client Impersonation (which fixes c-ip but requires every backend's default gateway to point at the appliance, with a documented performance cost) versus the default X-Forwarded-For header. Why Barracuda's own IIS procedure cannot be followed on IIS 10: it depends on the Microsoft Advanced Logging extension, which Microsoft has discontinued and which required IIS 7 on Windows Server 2008, and its IIS 8.5 successor writes a custom column that leaves c-ip showing the appliance. - [Real client IP in IIS behind Akamai](https://winfrasoft.com/kb/iis-real-client-ip-behind-akamai/): Akamai sends X-Forwarded-For to the origin by default and passes an inbound chain through rather than replacing it, while True-Client-IP is off unless the Send True Client IP Header option is enabled in the Origin Server behavior in Property Manager. Why the single-value True-Client-IP header is not inherently more trustworthy than X-Forwarded-For: its name is configurable via the True Client IP Header Name field so hardcoding the default breaks silently, a separate Allow Clients To Set True Client IP Header toggle governs whether a client-supplied value is passed through and accepted, and a single address carries no chain to validate against a trust list. Also origin reachability and Akamai Site Shield, which provides a defined set of IP CIDR ranges to allowlist at the perimeter so the origin cannot be reached directly. - [Barracuda and IIS 10: the Advanced Logging route is gone](https://winfrasoft.com/kb/barracuda-advanced-logging-iis-10/): Barracuda's only IIS article covers IIS 7 and 7.5 and opens by telling you to install the Microsoft Advanced Logging extension. Microsoft has discontinued it ("this download is no longer available"), both download links in Barracuda's article are dead, its readme required IIS 7 on Windows Server 2008, and a Microsoft staff answer states it only supports versions before IIS 8. Walks through the modern replacement, Enhanced Logging in IIS 8.5 and later, and the four things it does not fix: c-ip still shows the appliance, IIS starts writing log files with _x appended to the name, custom fields are site-level only, and the column holds the raw untrusted header chain. - [Real client IP in IIS behind Cloudflare](https://winfrasoft.com/kb/iis-real-client-ip-behind-cloudflare/): Restoring the real visitor IP in IIS logs when Cloudflare is the reverse proxy. - [Real client IP in IIS behind F5 BIG-IP](https://winfrasoft.com/kb/iis-real-client-ip-behind-f5-big-ip/): Enabling Insert X-Forwarded-For on the F5 HTTP profile and logging the real client in IIS. - [Real client IP in IIS behind an AWS load balancer](https://winfrasoft.com/kb/iis-real-client-ip-behind-aws-load-balancer/): Using the X-Forwarded-For header an AWS ALB/ELB adds automatically. - [Real client IP in IIS behind Azure App Gateway / Front Door](https://winfrasoft.com/kb/iis-real-client-ip-behind-azure/): Logging the real client IP behind Azure Application Gateway or Front Door. - [Real client IP in IIS behind ARR](https://winfrasoft.com/kb/iis-real-client-ip-behind-arr/): Preserving the client IP across a Microsoft Application Request Routing reverse proxy hop. - [Real client IP in IIS behind Nginx or HAProxy](https://winfrasoft.com/kb/iis-real-client-ip-behind-nginx-haproxy/): Configuring proxy_set_header in Nginx and option forwardfor in HAProxy, neither of which sends the client IP by default, then logging it in IIS. - [ASP.NET Core UseForwardedHeaders behind a proxy](https://winfrasoft.com/kb/aspnet-core-forwarded-headers/): ForwardedHeadersOptions, KnownProxies versus KnownNetworks and their defaults, CIDR ranges, the dual-stack IPv4-mapped IPv6 matching trap, the .NET 10 move to KnownIPNetworks (warning ASPDEPR005), middleware order, ForwardLimit and ForwardedForHeaderName; how the middleware fixes the application view of the client IP but not the IIS W3C log. - [Replacing the F5 X-Forwarded-For ISAPI filter on IIS 10](https://winfrasoft.com/kb/f5-isapi-filter-iis-10-replacement/): F5 published two community IIS components on DevCentral, an older ISAPI filter and the newer F5XFFHttpModule HTTP module for IIS 7, and archived the source in May 2016 before Windows Server 2016 shipped. Microsoft's guidance is that neither works on IIS 10, and there is a field report of the ISAPI filter crashing IIS 10 worker processes. Separately, neither validates the forwarding chain: the published source has no trust list, so a forged header is written into c-ip as fact. How to tell which component you have, the alternatives, and how to migrate. - [IIS client IP for SIEM and compliance](https://winfrasoft.com/kb/iis-client-ip-siem-compliance/): Why SIEM connectors and compliance parsers key off the standard c-ip field, why a custom log column does not satisfy them, and why an unvalidated X-Forwarded-For header weakens an audit trail. - [Exchange behind a load balancer: the real client IP](https://winfrasoft.com/kb/exchange-client-ip-load-balancer/): On-premises Exchange (OWA, ActiveSync, ECP, EWS) published through an F5, NetScaler or Azure Application Gateway logs the balancer's address. Fixing the IIS audit trail versus the free native Enable Proxy Mode fix for IP Address and Domain Restrictions. - [SharePoint behind a reverse proxy: the real client IP](https://winfrasoft.com/kb/sharepoint-client-ip-reverse-proxy/): Multi-WFE SharePoint farms published through a load balancer log the proxy's address in IIS. Getting the real client IP into the c-ip field farm-wide, and the distinction from SharePoint's own audit/usage logs. - [Frequently asked questions](https://winfrasoft.com/kb/faq/): Common questions on logging the real client IP in IIS, replacing the legacy F5 ISAPI filter, and Exchange behind a load balancer. - [Config samples on GitHub](https://github.com/Winfrasoft/iis-real-client-ip): Working reverse-proxy configurations (nginx, HAProxy, Apache, IIS ARR, F5 BIG-IP, AWS, Azure, Cloudflare), an ASP.NET Core forwarded-headers sample, a script for the native IIS custom log field, and PowerShell diagnostics for auditing the c-ip field and testing a proxy trust list. MIT licensed. ## Company - [About Winfrasoft](https://winfrasoft.com/#about): Company history since 2005, serving enterprise, government and NHS customers. - [Legacy products](https://winfrasoft.com/products/legacy/): End-of-life products retained for customer reference, covering VPN-Q 2010, X-Forwarded-For and X-Username for TMG/ISA Server, TMG & UAG appliances, NHS Health Access System. ## Optional - [Contact](https://winfrasoft.com/#contact): info@winfrasoft.com. Winfrasoft Corporation, 306 Victoria House, Victoria, Mahe, Seychelles. - [Privacy Policy](https://winfrasoft.com/privacy/): What personal data is collected via the contact/download forms, cookieless analytics, and how to request access or deletion.