Cannot update firewall rules behind reverse-proxy

François Seguin
(@nuseguinf)

1 week, 2 days ago

Hello,

I am stuck in making Wordfence firewall update its rules. I manage a server in a University with complex networking (VLANs, http proxies and reverse-proxies). I tried many settings in the “General Wordfence Options” > “How does Wordfence get IPs”, the correct setting being “X-Forwarded-For” according to me. I “trusted” our reverse-proxies, too. The “Diagnostics” tool shows success for an IPv4 “Connectivity”, and shows failure for an IPv6 one (which normally shouldn’t block the process, as long as IPv4 works)¹. It is also noticed in the “IP Detection” section, that the X-Forwarded-For is “Configured but not valid”. Though, it shows my client IP correctly (which is a local network address).

I can’t get anything interesting in the WordPress and system logs, even in DEBUG mode.

Other plugins, including Wordfence, and WordPress itself do auto-updates well. I think rules update never worked on that machine, since its installation, in June 2024.

¹ wp_remote_post() test back to this server failed
Response was: cURL error 7: Failed to connect to hashtag-infos.fr port 443 after 1 ms:
Could not connect to server

The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)

Plugin Support

(@wfpeter)

Hi @nuseguinf, thanks for your detailed message.

We generally don’t support staging or local installations, so the network configuration with local IP addresses might be problematic. I don’t want to jump to conclusions with that though as you’re seeing IPv4 connectivity and WordPress appears to be working in terms of plugin updates etc.

If you have a shell on your server, try running curl -v https://www.yoursitehere.com/ and send us the output here. It’s not a perfect test since it’s not within PHP, but it may show the route failing and a possible communication issue that can be corrected.

It may also be useful to export your Wordfence > Tools > Diagnostics page as a txt file in Wordfence directly. Please then attach and send it from your email account to wftest @ wordfence . com with your username in the subject line. Let me know if you do send that over as the inbox is unmonitored.

Many thanks,
Peter.

Thread Starter

François Seguin

(@nuseguinf)

2 days, 10 hours ago

Hi Peter,

Thank you for taking my issue into account. I followed your instructions and sent Diagnostics page to the right address.

And here is the result (/dev/stderr) of the curl -v command, which downloads the expected HTML (/dev/stdout).

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Host cache.ha.univ-nantes.fr:3128 was resolved.
* IPv6: 2001:660:7220:386:193:52:104:20
* IPv4: 193.52.104.20
*   Trying [2001:660:7220:386:193:52:104:20]:3128...
* Immediate connect fail for 2001:660:7220:386:193:52:104:20: Le réseau n'est pas accessible
*   Trying 193.52.104.20:3128...
* CONNECT tunnel: HTTP/1.1 negotiated
* allocate connect buffer
* Establish HTTP proxy tunnel to hashtag-infos.fr:443
> CONNECT hashtag-infos.fr:443 HTTP/1.1
> Host: hashtag-infos.fr:443
> User-Agent: curl/8.14.1
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 200 Connection established
< 
* CONNECT phase completed
* CONNECT tunnel established, response 200
* ALPN: curl offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1571 bytes data]
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
{ [1 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [25 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2996 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [79 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / id-ecPublicKey
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: C=FR; ST=Pays de la Loire; L=Nantes; O=NANTES UNIVERSIT�; CN=*.hashtag-infos.fr
*  start date: Jul 23 14:52:03 2026 GMT
*  expire date: Feb  7 14:52:02 2027 GMT
*  subjectAltName: host "hashtag-infos.fr" matched cert's "hashtag-infos.fr"
*  issuer: C=GR; O=Hellenic Academic and Research Institutions CA; CN=GEANT TLS ECC 1
*  SSL certificate verify ok.
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
* Connected to cache.ha.univ-nantes.fr (193.52.104.20) port 3128
* using HTTP/1.x
} [5 bytes data]
> GET / HTTP/1.1
> Host: hashtag-infos.fr
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0< HTTP/1.1 200 OK
< Date: Mon, 31 Aug 2026 13:36:59 GMT
< Server: Koala Web Server/2.4.0 (FreeBSD 15.0)
< Content-Type: text/html; charset=UTF-8
< Link: <https://hashtag-infos.fr/wp-json/>; rel="https://api.w.org/"
< Strict-Transport-Security: max-age=15552000; includeSubdomains; preload
< Vary: Accept-Encoding
< Connection: close
< Transfer-Encoding: chunked
< 
{ [7837 bytes data]
100  227k    0  227k    0     0   178k      0 --:--:--  0:00:01 --:--:--  178k
* shutting down connection #0

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.

Tags