Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VDS server running Windows Server Web 2008 and plesk 10 installed. I figured out I'm getting not the visitor IP but a fixed IP ( at my website codes I also get this IP in IIS log files. Can anybody explain what is happening?

My server ips are - and my subnet mask is One of the websites running on this server is

Question on Stack Overflow about same problem Cannot get user IP address

UPDATE Company suggested me to use HTTP_CLIENT_IP header instead of REMOTE_ADDR, also for the IIS logs I have to use XCLIENT.DLL for Microsoft Internet Information Services ISAPI filter.

How to Make the Web Server Logs Display the Real IP Address of the Client as the Source IP Address for All HTTP Requests?

And here is another useful article: HOWTO: ISAPI Filter which Logs original Client IP for Load Balanced IIS Servers

share|improve this question
and what exactly is – ST8Z6FR57ABE6A8RE9UF May 17 '11 at 23:40
I don't know exactly what it is's host name is but has no host name. – Hasan Gürsoy May 17 '11 at 23:50
It has 00-D0-68-11-C2-7C MAC address which seems to be a IWILL CORPORATION product. It could be a Server, Workstation or Security Appliance – Hasan Gürsoy May 17 '11 at 23:53 is apparently a proxy and/or firewall that all your incoming requests are coming through. When I visit, I do see my IP address in the HTTP_CLIENT_IP field, which is why I suspect that your mystery .2 appliance is indeed a proxy, and apparently a transparent one, as an nslookup on returns

In your code, you should use this field to determine your visitors' IP addresses, as well as update your logs to log this header (sorry, don't know how to do this for IIS). But beware that what works on these servers likely will not work in another environment/on another network.

share|improve this answer
Yes I have to use this header. Also I have to install an ISAPI filter: I'll post here if the problem is solved or not. Thanks. – Hasan Gürsoy May 18 '11 at 7:41

could it be that your router/default gateway is natting incoming requests so that your server logs fill with that devices ip?

share|improve this answer
I don't think so. Even Google sees this ip when it visits my log page: – Hasan Gürsoy May 18 '11 at 0:30

Try get this


in my case it works.

share|improve this answer
REMOTE_ADDR works but It's too hard to change all wordpress sites for this situation. – Hasan Gürsoy Jun 7 '12 at 22:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.