# IP Lookup to respect X-Forwarded-IP from AWS Load Balancer?

**URL:** https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823
**Category:** Docker support
**Tags:** discussion
**Created:** [October 31, 2025, 6:10am UTC](https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823 "2025-10-31T06:10:59Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![xuchen](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/xuchen/32/14558_2.png) [@xuchen](https://forum.mautic.org/u/xuchen)
#### Post date: [October 31, 2025, 6:10am UTC](https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823/1 "2025-10-31T06:10:59Z")

</div>

Trying my best to give all the details for any kind-hearted person to help me here:

I’m using Mautic 6.0.6 with Apache, pulled the docker setup from the official github repo.

My setup is:

1. Running Mautic docker containers in a VM on AWS
2. AWS ELB sends the traffic to Mautic
3. Correctly installed the GeoLite2 database

The problem is:

1. After a campaign is sent, the World map shows nothing
2. I further discovered that the tracked IP on the campaign is 127.0.0.1

When I opened an email, I see from the `mautic-web container's log:`

```auto
mautic_web-1 | 172.38.0.28 - - [31/Oct/2025:05:42:28 +0000] "GET /media/images/enable-executive-insights.jpeg HTTP/1.1" 200 127688 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)"
mautic_web-1 | 172.38.0.28 - - [31/Oct/2025:05:42:28 +0000] "GET /media/images/executive-insights-example.jpeg HTTP/1.1" 200 215023 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)"
mautic_web-1 | 172.35.0.25 - - [31/Oct/2025:05:42:28 +0000] "GET /email/69044704056ac477007023.gif HTTP/1.1" 200 414 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)"
mautic_web-1 | 127.0.0.1 - - [31/Oct/2025:05:42:35 +0000] "GET / HTTP/1.1" 301 623 "-" "curl/7.88.1"

```

LLM gave me these analysis:

```auto
   1. 172.38.0.28 and 172.35.0.25 are internal Docker network IPs - these are requests coming from your
      ELB/other Docker containers
   2. When the email tracking pixel is loaded (/email/69044704056ac477007023.gif), it's coming from
      172.35.0.25 (another internal Docker network IP)
   3. Most importantly: 127.0.0.1 - this last request shows that Mautic is seeing the tracking pixel
      request as coming from localhost/its own server

```

I’ve configured the ELB to append the client IP to the `X-Forwarded-For` header. I have `reverse_proxy=true` too

In this scenario, can I still get Mautic to recognize the correct client IP and location? Thank you.

---

<div class="post-metadata">

### Author: ![maxs05](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/maxs05/32/13380_2.png) [@maxs05](https://forum.mautic.org/u/maxs05)
#### Post date: [November 14, 2025, 1:12am UTC](https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823/2 "2025-11-14T01:12:49Z")

</div>

Hi @xuchen , did you work out a solution for this?

---

<div class="post-metadata">

### Author: ![xuchen](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/xuchen/32/14558_2.png) [@xuchen](https://forum.mautic.org/u/xuchen)
#### Post date: [November 17, 2025, 5:59pm UTC](https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823/3 "2025-11-17T17:59:44Z")

</div>

Unfortunately I never got to work it out.. I’m not sure whether this topic is too small that most people have not worked on

---

<div class="post-metadata">

### Author: ![marcus42](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@marcus42](https://forum.mautic.org/u/marcus42)
#### Post date: [November 18, 2025, 2:03pm UTC](https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823/4 "2025-11-18T14:03:14Z")

</div>

The 127.0.0.1 bit is local. Totally normal and expected. It’s noise in your investigation. Simply ignore it.

Visitor IPs are in the 172.0.0.0/8 cidr

The problem is most likely coming from a missing module on your webserver. On an apache or LSWS server, that would be the mod\_remoteip

Further configuration may also be required (i.e. the log format)

With that said, I’m not using the docker version. So I’m unaware what is the web server used in it. Still, the same logic should apply.

---

<div class="post-metadata">

### Author: ![silavapi](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/silavapi/32/7424_2.png) [@silavapi](https://forum.mautic.org/u/silavapi)
#### Post date: [November 18, 2025, 2:33pm UTC](https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823/5 "2025-11-18T14:33:37Z")

</div>

Are you using Cloudflare in front of your domain? If so, you might need to set the forwarding there, too. Once it comes back online, that is, given the current outage!

---

<div class="post-metadata">

### Author: ![xuchen](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/xuchen/32/14558_2.png) [@xuchen](https://forum.mautic.org/u/xuchen)
#### Post date: [November 24, 2025, 3:55pm UTC](https://forum.mautic.org/t/ip-lookup-to-respect-x-forwarded-ip-from-aws-load-balancer/36823/6 "2025-11-24T15:55:57Z")

</div>

Not sure about it. We put it behind an AWS ELB, I don’t see anything mentioning Cloudflare.
