Server records wrong IP (proxy/firewall/load balancer)

Question

I have a VDS server running Windows Server Web 2008 and plesk 10 installed. I figured out I'm getting not the visitor IP but a fixed IP (178.18.198.2) at my website codes asp.net/php. I also get this IP in IIS log files. Can anybody explain what is happening?

My server ips are 178.18.198.90 - 178.18.198.94 and my subnet mask is 178.18.198.1. One of the websites running on this server is innovacube.com

Question on Stack Overflow about same problem Cannot get user IP address

UPDATE Company suggested me to use HTTP_CLIENT_IP header instead of REMOTE_ADDR, also for the IIS logs I have to use XCLIENT.DLL for Microsoft Internet Information Services ISAPI filter.

How to Make the Web Server Logs Display the Real IP Address of the Client as the Source IP Address for All HTTP Requests?

And here is another useful article: HOWTO: ISAPI Filter which Logs original Client IP for Load Balanced IIS Servers

Answer 1

178.18.198.2 is apparently a proxy and/or firewall that all your incoming requests are coming through. When I visit http://innovacube.com/key.aspx, I do see my IP address in the HTTP_CLIENT_IP field, which is why I suspect that your mystery .2 appliance is indeed a proxy, and apparently a transparent one, as an nslookup on innovacube.com returns 178.18.198.90.

In your code, you should use this field to determine your visitors' IP addresses, as well as update your logs to log this header (sorry, don't know how to do this for IIS). But beware that what works on these servers likely will not work in another environment/on another network.

Answer 2

could it be that your router/default gateway is natting incoming requests so that your server logs fill with that devices ip?

Answer 3

Try get this

context.Request.ServerVariables["HTTP_X_CLUSTER_CLIENT_IP"]

in my case it works.