Does Azure Firewall See Original Client IP When Using Azure Front Door ?

Question

Does Azure Firewall See Original Client IP When Using Azure Front Door ?

$@chin 320

Is it useful to block original client IPs at Azure Firewall when Azure Front Door is in front of it ?

Client → Azure Front Door → Azure Firewall → backends....

In this design, Azure Front Door is the public entry point. The traffic then goes to Azure Firewall and finally to backend systems. I observed that Azure Firewall only receives connections from Azure Front Door’s POP IP addresses, and the firewall logs do not show the actual client’s public IP address. Instead, they show the Front Door IP as the source

Is there any scenario where Azure Firewall can see the actual client IP when Front Door is in front of it ?

How to preserve client IP with AFD ?

Steve 20 Reputation points

2025-11-30T19:59:46.23+00:00

“Thanks for the explanation — this helped.”
Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator

2025-12-01T03:59:21.87+00:00

Hello @$@chin,

Thanks for reaching out to Microsoft Q&A.

I understand that you're trying to figure out whether Azure Firewall can see the original client IP when Azure Front Door (AFD) is used as a front-end.

When Azure Front Door (AFD) is positioned before Azure Firewall, traffic passes through AFD first. As a result, the firewall usually sees AFD’s IP addresses as the source, rather than the original client IP.

Azure Front Door includes the X-Forwarded-For header, which carries the actual client IP in the request sent to the backend, including Azure Firewall.

Check the firewalls and network configurations to ensure that there are no rules that might strip away this header before it reaches your backend services.

Use Azure Front Door’s capabilities to handle the X-Forwarded-For header. Azure Front Door adds this header by default, and it should be available to your backend.

Reference Documents:
Azure Front Door's HTTP headers

Kindly let us know if the above helps or you need further assistance on this issue.Please "upvote" if the information helped you. This will help us and others in the community as well.

1 answer

Your answer

Steve 20 Reputation points

2025-11-30T19:59:46.23+00:00

“Thanks for the explanation — this helped.”
Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator

2025-12-01T03:59:21.87+00:00

Hello @$@chin,

Thanks for reaching out to Microsoft Q&A.

I understand that you're trying to figure out whether Azure Firewall can see the original client IP when Azure Front Door (AFD) is used as a front-end.

When Azure Front Door (AFD) is positioned before Azure Firewall, traffic passes through AFD first. As a result, the firewall usually sees AFD’s IP addresses as the source, rather than the original client IP.

Azure Front Door includes the X-Forwarded-For header, which carries the actual client IP in the request sent to the backend, including Azure Firewall.

Check the firewalls and network configurations to ensure that there are no rules that might strip away this header before it reaches your backend services.

Use Azure Front Door’s capabilities to handle the X-Forwarded-For header. Azure Front Door adds this header by default, and it should be available to your backend.

Reference Documents:
Azure Front Door's HTTP headers

Kindly let us know if the above helps or you need further assistance on this issue.Please "upvote" if the information helped you. This will help us and others in the community as well.

Answer 1

Azure Firewall will not see the original client IP when Azure Front Door is in front of it. In your described architecture, Azure Front Door acts as the public entry point and forwards requests to Azure Firewall. As a result, Azure Firewall only receives connections from Azure Front Door’s Point of Presence (POP) IP addresses, and the logs will reflect these IPs as the source instead of the actual client IPs.

To preserve the original client IP when using Azure Front Door, you can utilize the X-Forwarded-For header. Azure Front Door supports this header, which includes the original client IP address in the request it forwards to your backend services. However, Azure Firewall itself does not extract this information from the X-Forwarded-For header for logging or filtering purposes. Therefore, while the original client IP can be passed to backend systems, Azure Firewall will still only log the Front Door IP as the source.

In summary, Azure Firewall cannot see the original client IP when Azure Front Door is in front of it, and there are no scenarios where it can do so unless the architecture is modified to allow the original IP to be captured and logged appropriately by the firewall.

References:

Share via

Does Azure Firewall See Original Client IP When Using Azure Front Door ?

1 answer

Your answer