diff --git a/data/conf/nginx/templates/nginx.conf.j2 b/data/conf/nginx/templates/nginx.conf.j2
index 861c7e560..94db35e03 100644
--- a/data/conf/nginx/templates/nginx.conf.j2
+++ b/data/conf/nginx/templates/nginx.conf.j2
@@ -47,6 +47,12 @@ http {
         default "";
     }
 
+    # client of an internal auth request, X-Real-IP is set by /sogo-auth-verify
+    map $server_port $sogo_auth_client_ip {
+        65510   $http_x_real_ip;
+        default "";
+    }
+
     {% if HTTP_REDIRECT %}
     # HTTP to HTTPS redirect
     server {
diff --git a/data/conf/nginx/templates/sites-default.conf.j2 b/data/conf/nginx/templates/sites-default.conf.j2
index 842c50a54..8a8d0950f 100644
--- a/data/conf/nginx/templates/sites-default.conf.j2
+++ b/data/conf/nginx/templates/sites-default.conf.j2
@@ -119,6 +119,7 @@ location ~ \.php$ {
     fastcgi_param HTTP_X_REAL_IP $remote_addr;
     # trusted internal-auth marker; empty for external clients (see nginx.conf map)
     fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
+    fastcgi_param SOGO_AUTH_CLIENT_IP $sogo_auth_client_ip;
     fastcgi_read_timeout 3600;
     fastcgi_send_timeout 3600;
 }
diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php
index bc9694d8e..ee921c4eb 100644
--- a/data/web/sogo-auth.php
+++ b/data/web/sogo-auth.php
@@ -12,6 +12,11 @@ $session_var_pass = 'sogo-sso-pass';
 // external clients can never supply it (bare fastcgi param, not an HTTP header)
 $is_internal_auth = (($_SERVER['SOGO_AUTH_INTERNAL'] ?? '') === '1');
 
+// the loopback is no client: use the client of the original request for logs, netfilter and API IP checks
+if ($is_internal_auth && filter_var($_SERVER['SOGO_AUTH_CLIENT_IP'] ?? '', FILTER_VALIDATE_IP)) {
+  $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'] = $_SERVER['SOGO_AUTH_CLIENT_IP'];
+}
+
 // validate credentials for basic auth requests
 if ($is_internal_auth && isset($_SERVER['PHP_AUTH_USER'])) {
   // load prerequisites only when required