20

I have the following code:

string ip = Request.ServerVariables["REMOTE_ADDR"];

Which, in the test environment does return the user IP addrress, but when we deploy the website to production, this variable has the IP of the server where the application is hosted. Any help?

Felix Martinez
  • 3,928
  • 3
  • 31
  • 32
  • 2
    What do you expect it to return? See this: http://stackoverflow.com/questions/3812166/difference-between-remote-host-and-remote-addr – Oded Aug 02 '11 at 15:26
  • 3
    @Oded That stackoverflow answer is accepted and has a number of upvotes but is nonetheless wrong. – mhenry1384 Jul 25 '13 at 14:46
  • The same `HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"].ToString();` and `Request.UserHostAddress.ToString();` – Kiquenet Nov 15 '16 at 10:27

3 Answers3

30

My guess is that there is a proxy in the middle. Use HTTP_X_FORWARDED_FOR first, and if that's null, then use REMOTE_ADDR

From the MSDN article:

Although retrieving just the REMOTE_ADDR server variable should be enough, I found resources online that suggested that code like this should also check the HTTP_X_FORWARDED_FOR variable; if the request comes through a proxy server that translates the address, it's this variable that contains the correct address. If you request a server variable that doesn't exist, the ServerVariables property returns an empty string. Therefore, even though this property doesn't appear in my tests, attempting to retrieve its value doesn't cause trouble.

UPDATE:

If it's a load balancer that you have have settings changed on, you should ask to see if they can have the origination IP passed through. I know this can be done with Microsoft's ISA server.

If that's not an option, there are these other server variables that you can try and see if they produce a result:

"HTTP_X_COMING_FROM"
"HTTP_X_FORWARDED_FOR"
"HTTP_X_FORWARDED"
"HTTP_X_REAL_IP"
"HTTP_VIA"
"HTTP_COMING_FROM"
"HTTP_FORWARDED_FOR"
"HTTP_FORWARDED"
"HTTP_FROM"
"HTTP_PROXY_CONNECTION"
"CLIENT_IP"
"FORWARDED"
Devtrix.net
  • 705
  • 7
  • 8
zeroef
  • 1,949
  • 23
  • 32
  • its wrong because if you have proxy then its always send you wrong ip address – Bhargav Mistri Aug 02 '11 at 15:34
  • @Bhargav Mistri - I have similar code running on multiple production boxes. I've ran into this in the past and can assure you it's due to a proxy issue. Keep in mind that some proxy servers can spoof HTTP_X_FORWARDED_FOR or leave it off all together. – zeroef Aug 02 '11 at 15:47
  • @zeroef Thanks for the help. I made the changes to HTTP_X_FOWARD_FOR but I'm still getting the same IP. I talked with the infrastructure team and I turns out that it's not the server IP that's returning, but actually a load balancer IP. Any thoughts? – Felix Martinez Aug 08 '11 at 14:29
  • I tested all this, but it doesn't work when there is Load Balancing in front of the web servers. – nemke Aug 03 '12 at 14:49
  • The load balancer needs to be configured to inject an X-Forwarded-For header in the request. It does not necessarily do it by default. – HaukurHaf May 14 '13 at 11:55
  • 2
    ***other server variables*** `documentation` ? any _reference_? – Kiquenet Nov 15 '16 at 10:31
4

Why do you use old, VB-style server variables instead of Request.UserHostAddress?

See MSDN Library.

As the others have stated, you will get the IP address of the reverse proxy/SSL terminator if it doesn't make the requests look like they come from the original client (As is possible at least in ISA server, and probably in most other reverse proxies).

If not, you will get the public address of the client (which is probably a router address at the client site, as most LANs are NAT-ed).

How does your setup in the production environment differ from your test environment?

Are you actually getting the IP address of the Web server, or of some other server in the same network?

Akhil Jain
  • 13,872
  • 15
  • 57
  • 93
Erik A. Brandstadmoen
  • 10,430
  • 2
  • 37
  • 55
0

I see this is an old question but I ran across it and I think I know the answer. The answer is simpler than those above... I just ran into the same issue today. I bet you are trying to get the IP from a page being called by XMLHTTP which will return the server IP since it is the one making the request and not the user.

Hamada
  • 146
  • 1
  • 8