Member Avatar for developer707

Hello,
Currently I am using my computer as a webserver, as I own an IP I have made the config to access it from outside.
So now I can access my php sripts via
The weird thing is that I cant get the visitors IP
This script is working very good on sites with no ip on the url. Could someone help me with this issue?!

function getUserIP(){
    $client  = @$_SERVER['HTTP_CLIENT_IP'];
    $forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
    $remote  = $_SERVER['REMOTE_ADDR'];
    if(filter_var($client, FILTER_VALIDATE_IP)){
            $ip = $client;
        }elseif(filter_var($forward, FILTER_VALIDATE_IP)){
            $ip = $forward;
        }else{
            $ip = $remote;
    }
    return $ip;
}
  • 2 Contributors
  • 1 Reply
  • 370 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

described a local machine exposed as where the usual PHP methods return the wrong visitor IP. 's suggestion to extend the header checks and to inspect webserver logs is a good start. The next steps are to confirm where the real TCP source address is being altered (network vs. application) and then act on that evidence.

A quick checklist to narrow the cause:

  • Confirm whether the request is coming from inside the same LAN (hairpin NAT) or truly from an external client (mobile data or a remote host). Hairpinning often makes the router appear as the source.
  • Capture packets on the server to see the TCP source IP. Example (replace PORT and iface as needed):
sudo tcpdump -n -i any tcp port PORT
  • Dump PHP/HTTP headers seen by the process to a file so they can be correlated with the packet capture:
<?php
file_put_contents('/tmp/server_vars.txt', print_r($_SERVER, true));
?>
  • Correlate the tcpdump output with the Apache/Nginx access log lines for the same request. If tcpdump shows the client's public IP, the problem is in the PHP logic or header parsing. If tcpdump shows the router/proxy IP, the network (router/ISP) is rewriting or proxying traffic.

If an intermediary (router, ISP modem, reverse proxy, SSH tunnel, or CGNAT) is rewriting source addresses, two typical remedies apply:

  • If the intermediary adds X-Forwarded-For, enable server-side support (Apache mod_remoteip or nginx real_ip_module) and restrict trusted proxy addresses so REMOTE_ADDR is replaced safely.
  • If the ISP uses carrier-grade NAT or a transparent proxy that does not forward the original IP, contact the ISP or move the server to an environment with a preserved client source (VPS, proper public IP, or use a reverse proxy that passes X-Forwarded-For).

Cautions: headers like X-Forwarded-For can be forged unless only accepted from trusted proxies. The packet capture step is the single most reliable way to know whether the real client IP ever reaches the server.

Member Avatar for cereal

Hi,

the code seems fine to me. But you can try this function which extends a bit the check:

function get_ip_address()
{
    $array = array(
        'HTTP_CLIENT_IP',
        'HTTP_X_FORWARDED_FOR',
        'HTTP_X_FORWARDED',
        'HTTP_X_CLUSTER_CLIENT_IP',
        'HTTP_FORWARDED_FOR',
        'HTTP_FORWARDED',
        'REMOTE_ADDR'
        );

    foreach($array as $key)
        if(array_key_exists($key, $_SERVER) === true)
            foreach(explode(',', $_SERVER[$key]) as $ip)
                if(filter_var($ip, FILTER_VALIDATE_IP) !== false)
                    return $ip;
}

Source: http://www.kavoir.com/2010/03/php-how-to-detect-get-the-real-client-ip-address-of-website-visitors.html

Besides: are you using Apache as webserver? Check the access and error logs for Apache and the error log for PHP, to verify if there's something wrong with your configuration. In particular the access log for Apache should save the IP address for each client request.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.