Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have encountered a strange issue and am curious if others have encountered this as well. and if there is absolutely anything that can be done..

We have a set up where we have multiple AWS EC2 Linux machines sitting behind a ELB. The EC2 machines are running Nginx. Let's refer to these as my production machines (because they are!)

I also have a Rackspace cloud machine running apache. Completely separate. Let's call this the test server.

Now, there's a ISP here in Singapore that seems to be funneling traffic through a transparent proxy or something, and when you do a IP check, the IP often changes.

In fact, I noticed that when I check on, the ip seems to be stable (doesn't change) across refreshes. But,, on refreshing, the IP changes! (so my ISP is doing weird stuff).

Now, back to my set up, I noticed a couple of things:

  1. Checking the REMOTE_ADDR variable from PHP when connecting to a single Nginx production machine (bypassing the load balancer), is set to the stable IP that does change.

  2. Checking the REMOTE_ADDR variable from PHP when connecting to the test Apache server, it is set to the IP that does change on refreshes.

  3. Checking the headers when connecting to the nginx production machines through the ELB, the ELB sets the HTTP_X_FORWARDED_FOR to the stable IP.

Has anyone experienced this odd behavior? Is there nothing that I can do? And which IP should I "trust"? (the one Apache gives, or the one ELB and Nginx gives?)



share|improve this question
Just pointing out a slight typo that is confusing. In 1. you state that the IP does change, I think you mean't doesn't change. – d34dh0r53 Dec 17 '12 at 11:29
Most ISPs in Singapore proxy their customers' web traffic. (And many other countries as well.) I ended up having to write my own IP address checking tool in order to determine the actual end user's address and reveal the existence of the proxy server. You may find it useful in helping to determine what's going on. – Michael Hampton Dec 17 '12 at 19:13

HTTP_X_FORWARDED_FOR is the most reliable way to get a user's IP address when your app is behind a reverse proxy/load balancer. However I don't know what you mean by "trust"? HTTP_X_FORWARDED_FOR is an HTTP header that can be easily modified by the client or any system between you and the client. You don't want to use it for anything like authentication.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.