diff --git a/synapse/app/homeserver.py b/synapse/app/homeserver.py
index 5c6812f473..0aa5c34c81 100755
--- a/synapse/app/homeserver.py
+++ b/synapse/app/homeserver.py
@@ -35,6 +35,7 @@ from twisted.enterprise import adbapi
 from twisted.web.resource import Resource
 from twisted.web.static import File
 from twisted.web.server import Site
+from twisted.web.http import proxiedLogFormatter
 from synapse.http.server import JsonResource, RootRedirect
 from synapse.rest.media.v0.content_repository import ContentRepoResource
 from synapse.rest.media.v1.media_repository import MediaRepositoryResource
@@ -225,10 +226,18 @@ class SynapseHomeServer(HomeServer):
     def start_listening(self):
         config = self.get_config()
 
+        log_formatter = None
+        if config.captcha_ip_origin_is_x_forwarded:
+            log_formatter = proxiedLogFormatter
+
         if not config.no_tls and config.bind_port is not None:
             reactor.listenSSL(
                 config.bind_port,
-                Site(self.root_resource),
+                Site(
+                    self.root_resource,
+                    logPath=config.access_log_file,
+                    logFormatter=log_formatter,
+                ),
                 self.tls_context_factory,
                 interface=config.bind_host
             )
@@ -237,7 +246,11 @@ class SynapseHomeServer(HomeServer):
         if config.unsecure_port is not None:
             reactor.listenTCP(
                 config.unsecure_port,
-                Site(self.root_resource),
+                Site(
+                    self.root_resource,
+                    logPath=config.access_log_file,
+                    logFormatter=log_formatter,
+                ),
                 interface=config.bind_host
             )
             logger.info("Synapse now listening on port %d", config.unsecure_port)
@@ -245,7 +258,13 @@ class SynapseHomeServer(HomeServer):
         metrics_resource = self.get_resource_for_metrics()
         if metrics_resource and config.metrics_port is not None:
             reactor.listenTCP(
-                config.metrics_port, Site(metrics_resource), interface="127.0.0.1",
+                config.metrics_port,
+                Site(
+                    metrics_resource,
+                    logPath=config.access_log_file,
+                    logFormatter=log_formatter,
+                ),
+                interface="127.0.0.1",
             )
             logger.info("Metrics now running on 127.0.0.1 port %d", config.metrics_port)
 
diff --git a/synapse/config/captcha.py b/synapse/config/captcha.py
index 07fbfadc0f..456ce9c632 100644
--- a/synapse/config/captcha.py
+++ b/synapse/config/captcha.py
@@ -22,6 +22,8 @@ class CaptchaConfig(Config):
         self.recaptcha_private_key = args.recaptcha_private_key
         self.recaptcha_public_key = args.recaptcha_public_key
         self.enable_registration_captcha = args.enable_registration_captcha
+
+        # XXX: This is used for more than just captcha
         self.captcha_ip_origin_is_x_forwarded = (
             args.captcha_ip_origin_is_x_forwarded
         )
diff --git a/synapse/config/logger.py b/synapse/config/logger.py
index 247b324816..559cbe7963 100644
--- a/synapse/config/logger.py
+++ b/synapse/config/logger.py
@@ -27,6 +27,7 @@ class LoggingConfig(Config):
         self.verbosity = int(args.verbose) if args.verbose else None
         self.log_config = self.abspath(args.log_config)
         self.log_file = self.abspath(args.log_file)
+        self.access_log_file = self.abspath(args.access_log_file)
 
     @classmethod
     def add_arguments(cls, parser):
@@ -44,6 +45,10 @@ class LoggingConfig(Config):
             '--log-config', dest="log_config", default=None,
             help="Python logging config file"
         )
+        logging_group.add_argument(
+            '--access-log-file', dest="access_log_file", default="access.log",
+            help="File to log server access to"
+        )
 
     def setup_logging(self):
         log_format = (