Configuring the Proxy Trust List
The Proxy Trust List tells Winfrasoft X-Forwarded-For for IIS which proxies and load balancers are yours, so it can log the real client and ignore forged addresses.
Short answer. List your proxies' and load balancers' IP addresses, comma-separated, as TrustList= in XFF4IIS.ini in the installation folder, then run IISRESET. The filter reads the address chain from right to left and logs the first address that isn't on the list as the client. With no list, it logs the whole chain.
Why is a trust list needed?
The X-Forwarded-For header is plain text in the request: it isn't signed or authenticated, so a client can put any address at the start of it. Logging "the first address in the header" would let anyone write a forged address into your logs. The trust list means only the hops you control are trusted, and the first untrusted hop, the host that connected to your outermost proxy, is logged as the client.
How does the filter choose the address?
It joins the X-Forwarded-For header and the layer-4 source address of the nearest proxy into one Proxy Chain List, then works in one of two modes:
- Real client IP (recommended): with a trust list, the chain is read right to left, starting nearest the web server, and the first address that isn't on the list is written to
c-ip. - Full chain: with no trust list, the whole chain and the layer-4 source are written to
c-ip, so no information is lost.
Worked example
A request reaches IIS through two trusted proxies:
X-Forwarded-For: 203.0.113.7, 198.51.100.23
Layer-4 source IP: 198.51.100.10
Proxy Trust List: 198.51.100.23, 198.51.100.10
The Proxy Chain List is 203.0.113.7, 198.51.100.23, 198.51.100.10. Read right to left, both 198.51.100.x addresses are trusted, so 203.0.113.7 is logged as the client:
#Fields: date time s-sitename s-ip cs-method cs-uri-stem s-port c-ip sc-status
2025-11-09 14:37:03 W3SVC1 192.0.2.10 GET /default.htm 443 203.0.113.7 200
If a client had put a forged address ahead of 203.0.113.7, the result would be the same: the first untrusted hop is still 203.0.113.7.
How do I set it?
Edit XFF4IIS.ini in the installation folder. List the IP addresses on one line, comma-separated:
[Config]
TrustList=198.51.100.23, 198.51.100.10
- Only IP addresses are accepted; host names are ignored.
- The file is read exactly as shown.
- Run
IISRESETfor changes to take effect. - Leave the list empty to log the complete chain instead.
Add every tier in front of IIS: for example, Cloudflare's published ranges and your own load balancer's address. The guides for Cloudflare, F5 BIG-IP, AWS and Azure list what to trust for each.
Frequently asked questions
Can I put host names in the trust list?
No. Only IP addresses are accepted; host names are ignored.
Do I need to restart IIS after changing it?
Yes. Run IISRESET for trust-list changes to take effect.
What gets logged if the trust list is empty?
The complete proxy chain, with the layer-4 source address, so nothing is lost.
Should I trust addresses from outside my organisation?
Only the proxies and services you actually route through, such as your CDN's published ranges. Never trust X-Forwarded-For information that originates outside your control, and lock your origin down so only your proxies can reach it.