Geek Answers Handbook

Getting users Real IP using PHP

I want to get a real IP address from users going to my site, even if they use a proxy site, for example hidemyass.com

This is the code I have, and thought it worked, but I tested it, and it doesn’t

<?php function getRealIpAddr() { if (!empty($_SERVER['HTTP_CLIENT_IP'])) //check ip from share internet { $ip=$_SERVER['HTTP_CLIENT_IP']; } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) //to check ip is pass from proxy { $ip=$_SERVER['HTTP_X_FORWARDED_FOR']; } else { $ip=$_SERVER['REMOTE_ADDR']; } return $ip; } ?>

I thought this code would work, but the proxy server bypasses it anyway.

Thanks in advance.

+2
source share
6 answers

There is no guaranteed way to get a “real” IP address if the proxy does not want to tell you about it (and there will be no true anonymous proxy).

+19
source

You can not. The information you have is from apache / iis / whatever, and it only knows who is talking to your server, which in this case is a proxy. If the proxy does not want to send this information to the header, you will not receive it.

X-Forwarded-For is the best you can do, but it is unlikely that an anonymous proxy server will send this message.

+6
source

It is not possible to get a “real” IP address unless you implement some kind of application-level authentication protocol that encodes the IP address (which is also to be determined).

Why is this?

Since the IP data packet can be arbitrarily rewritten by someone in the middle who has access to it. For example, proxies, routers, gateways, etc.

IP data packet has this structure

 | stuff | src ip | dst ip | stuff | | .... | 32-bits| 32 bits | stuff |

So src ip are just bits, remember - they can be overwritten arbitrarily.

http://www.faqs.org/rfcs/rfc791.html will give more information.

+5
source

If the proxy does not put the real IP address in the headers (general - depending on why the proxy is used) (usually in some form of "X-something"), you can only see the IP address of the proxy server.

+2
source

I found a similar entry here to check for multiple headers to see if the user is using a proxy, which can help

determine if the user is using a proxy

0
source

Try it please

 function get_IP_address() { foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key){ if (array_key_exists($key, $_SERVER) === true){ foreach (explode(',', $_SERVER[$key]) as $IPaddress){ $IPaddress = trim($IPaddress); // Just to be safe if (filter_var($IPaddress, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false) { return $IPaddress; } } } } }
0
source

More articles:


All Articles