Title: Cannot update firewall rules behind reverse-proxy Last modified: August 24, 2026 --- # Cannot update firewall rules behind reverse-proxy * [François Seguin](https://wordpress.org/support/users/nuseguinf/) * (@nuseguinf) * [1 week, 5 days ago](https://wordpress.org/support/topic/cannot-update-firewall-rules-behind-reverse-proxy/) * Hello, * I am stuck in making Wordfence firewall update its rules. I manage a server in a University with complex networking (VLANs, http proxies and reverse-proxies). I tried many settings in the “General Wordfence Options” > “How does Wordfence get IPs”, the correct setting being “X-Forwarded-For” according to me. I “trusted” our reverse-proxies, too. The “Diagnostics” tool shows success for an IPv4 “Connectivity”, and shows failure for an IPv6 one (which normally shouldn’t block the process, as long as IPv4 works)¹. It is also noticed in the “IP Detection” section, that the X-Forwarded-For is “Configured but not valid”. Though, it shows my client IP correctly (which is a local network address). * I can’t get anything interesting in the WordPress and system logs, even in DEBUG mode. * Other plugins, including Wordfence, and WordPress itself do auto-updates well. I think rules update never worked on that machine, since its installation, in June 2024. * ¹ wp_remote_post() test back to this server failed Response was: cURL error 7: Failed to connect to hashtag-infos.fr port 443 after 1 ms:Could not connect to server * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcannot-update-firewall-rules-behind-reverse-proxy%2F%3Foutput_format%3Dmd&locale=en_US) to see the link]_ Viewing 3 replies - 1 through 3 (of 3 total) * Plugin Support [wfpeter](https://wordpress.org/support/users/wfpeter/) * (@wfpeter) * [1 week, 1 day ago](https://wordpress.org/support/topic/cannot-update-firewall-rules-behind-reverse-proxy/#post-19005185) * Hi [@nuseguinf](https://wordpress.org/support/users/nuseguinf/), thanks for your detailed message. * We generally don’t support staging or local installations, so the network configuration with local IP addresses might be problematic. I don’t want to jump to conclusions with that though as you’re seeing IPv4 connectivity and WordPress appears to be working in terms of plugin updates etc. * If you have a shell on your server, try running `curl -v https://www.yoursitehere. com/` and send us the output here. It’s not a perfect test since it’s not within PHP, but it may show the route failing and a possible communication issue that can be corrected. * It may also be useful to export your **Wordfence > Tools > Diagnostics** page as a **txt** file in Wordfence directly. Please then attach and send it from your email account to **wftest @ wordfence . com** with your username in the subject line. Let me know if you do send that over as the inbox is unmonitored. * Many thanks, Peter. * Thread Starter [François Seguin](https://wordpress.org/support/users/nuseguinf/) * (@nuseguinf) * [5 days, 3 hours ago](https://wordpress.org/support/topic/cannot-update-firewall-rules-behind-reverse-proxy/#post-19007575) * Hi Peter, * Thank you for taking my issue into account. I followed your instructions and sent Diagnostics page to the right address. * And here is the result (/dev/stderr) of the curl -v command, which downloads the expected HTML (/dev/stdout). * ```wp-block-code % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Host cache.ha.univ-nantes.fr:3128 was resolved.* IPv6: 2001:660:7220:386:193:52:104:20* IPv4: 193.52.104.20* Trying [2001:660:7220:386:193:52:104:20]:3128...* Immediate connect fail for 2001:660:7220:386:193:52:104:20: Le réseau n'est pas accessible* Trying 193.52.104.20:3128...* CONNECT tunnel: HTTP/1.1 negotiated* allocate connect buffer* Establish HTTP proxy tunnel to hashtag-infos.fr:443> CONNECT hashtag-infos.fr:443 HTTP/1.1> Host: hashtag-infos.fr:443> User-Agent: curl/8.14.1> Proxy-Connection: Keep-Alive> < HTTP/1.1 200 Connection established< * CONNECT phase completed* CONNECT tunnel established, response 200* ALPN: curl offers h2,http/1.1} [5 bytes data]* TLSv1.3 (OUT), TLS handshake, Client hello (1):} [1571 bytes data]* CAfile: /etc/ssl/certs/ca-certificates.crt* CApath: /etc/ssl/certs{ [5 bytes data]* TLSv1.3 (IN), TLS handshake, Server hello (2):{ [122 bytes data]* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):{ [1 bytes data]* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):{ [25 bytes data]* TLSv1.3 (IN), TLS handshake, Certificate (11):{ [2996 bytes data]* TLSv1.3 (IN), TLS handshake, CERT verify (15):{ [79 bytes data]* TLSv1.3 (IN), TLS handshake, Finished (20):{ [52 bytes data]* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):} [1 bytes data]* TLSv1.3 (OUT), TLS handshake, Finished (20):} [52 bytes data]* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / id-ecPublicKey* ALPN: server accepted http/1.1* Server certificate:* subject: C=FR; ST=Pays de la Loire; L=Nantes; O=NANTES UNIVERSIT�; CN=*.hashtag-infos.fr* start date: Jul 23 14:52:03 2026 GMT* expire date: Feb 7 14:52:02 2027 GMT* subjectAltName: host "hashtag-infos.fr" matched cert's "hashtag-infos.fr"* issuer: C=GR; O=Hellenic Academic and Research Institutions CA; CN=GEANT TLS ECC 1* SSL certificate verify ok.* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384* Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384* Connected to cache.ha.univ-nantes.fr (193.52.104.20) port 3128* using HTTP/1.x} [5 bytes data]> GET / HTTP/1.1> Host: hashtag-infos.fr> User-Agent: curl/8.14.1> Accept: */*> * Request completely sent off{ [5 bytes data]* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):{ [57 bytes data]* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):{ [57 bytes data] 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0< HTTP/1.1 200 OK< Date: Mon, 31 Aug 2026 13:36:59 GMT< Server: Koala Web Server/2.4.0 (FreeBSD 15.0)< Content-Type: text/html; charset=UTF-8< Link: ; rel="https://api.w.org/"< Strict-Transport-Security: max-age=15552000; includeSubdomains; preload< Vary: Accept-Encoding< Connection: close< Transfer-Encoding: chunked< { [7837 bytes data]100 227k 0 227k 0 0 178k 0 --:--:-- 0:00:01 --:--:-- 178k* shutting down connection #0 ``` * Plugin Support [wfmargaret](https://wordpress.org/support/users/wfmargaret/) * (@wfmargaret) * [1 day, 1 hour ago](https://wordpress.org/support/topic/cannot-update-firewall-rules-behind-reverse-proxy/#post-19011882) * Hi [@nuseguinf](https://wordpress.org/support/users/nuseguinf/), * Thanks for sending the diagnostics. Does your configuration require all outbound connections to go through the proxy? If so, that’s likely the issue. * The firewall fetches its rules directly from noc4.wordfence.com and doesn’t read the constants WP_PROXY_HOST and WP_PROXY_PORT, so on a network where everything has to go out through a proxy, that request never completes. We have an issue created to address this, but I can’t provide timelines or updates on the forum. * The workaround is to set the proxy through cURL’s own environment variables instead, which the firewall’s request will pick up. We can’t assist with custom development, but you could use something such as the following at the top of the wordfence- waf.php file if your firewall is optimized: * ```wp-block-code putenv('HTTPS_PROXY=http://your.proxy.host:PORT');putenv('NO_PROXY=yoursite.example'); ``` * Regarding the IP detection, the issue is that you were on the local network. Wordfence won’t select a private address as the visitor IP when a public one is available. * Please let me know how it goes! * Thanks, Margaret Viewing 3 replies - 1 through 3 (of 3 total) You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcannot-update-firewall-rules-behind-reverse-proxy%2F%3Foutput_format%3Dmd&locale=en_US) to reply to this topic. * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865) * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/) * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq) * [Support Threads](https://wordpress.org/support/plugin/wordfence/) * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/) ## Tags * [firewall rules](https://wordpress.org/support/topic-tag/firewall-rules/) * [proxy](https://wordpress.org/support/topic-tag/proxy/) * [reverse proxy](https://wordpress.org/support/topic-tag/reverse-proxy/) * 3 replies * 3 participants * Last reply from: [wfmargaret](https://wordpress.org/support/users/wfmargaret/) * Last activity: [1 day, 1 hour ago](https://wordpress.org/support/topic/cannot-update-firewall-rules-behind-reverse-proxy/#post-19011882) * Status: not resolved