Why does ServerVariable["REMOTE_ADDR"] returns the server IP?

Question

I have the following code:

string ip = Request.ServerVariables["REMOTE_ADDR"];

Which, in the test environment does return the user IP addrress, but when we deploy the website to production, this variable has the IP of the server where the application is hosted. Any help?

Answer 1

My guess is that there is a proxy in the middle. Use HTTP_X_FORWARDED_FOR first, and if that's null, then use REMOTE_ADDR

From the MSDN article:

Although retrieving just the REMOTE_ADDR server variable should be enough, I found resources online that suggested that code like this should also check the HTTP_X_FORWARDED_FOR variable; if the request comes through a proxy server that translates the address, it's this variable that contains the correct address. If you request a server variable that doesn't exist, the ServerVariables property returns an empty string. Therefore, even though this property doesn't appear in my tests, attempting to retrieve its value doesn't cause trouble.

UPDATE:

If it's a load balancer that you have have settings changed on, you should ask to see if they can have the origination IP passed through. I know this can be done with Microsoft's ISA server.

If that's not an option, there are these other server variables that you can try and see if they produce a result:

"HTTP_X_COMING_FROM"
"HTTP_X_FORWARDED_FOR"
"HTTP_X_FORWARDED"
"HTTP_X_REAL_IP"
"HTTP_VIA"
"HTTP_COMING_FROM"
"HTTP_FORWARDED_FOR"
"HTTP_FORWARDED"
"HTTP_FROM"
"HTTP_PROXY_CONNECTION"
"CLIENT_IP"
"FORWARDED"