Cloudflare is giving me the wrong IP when I use getenv(REMOTE_ADDR)

Question

I have a test php code. Which essentially grabs the IP of someone and emails it to an address. I plan later on storing it in a database, but just for testing purposes I have put it as emailing me.

My issue is, I have cloudflare enabled so when I use getenv(REMOTE_ADDR) it gives me cloudflare's IP rather than the actual visitors IP. Is there a way I can get the visitor's IP?

<?php
$ip = getenv(REMOTE_ADDR);
mail("[email protected]", "You got a visitor", "IP: ".$ip);
?>

Answer 1

Of course it is, Cloudflare hides your server real address from the user by intermediating the connection (reverse Proxy), and at the same rate you see the proxy's IP accessing the page instead of the user's.

But they report the real IP through the header CF-Connecting-IP and other useful headers Cloudflare generate to figure out the user's real origin.

Try again with $_SERVER['HTTP_CF_CONNECTING_IP'] instead of getenv(REMOTE_ADDR) and see what happens.

Answer 2

If you're using Nginx you can also just correct this at the web server level before PHP even gets involved, in which case $ip = getenv(REMOTE_ADDR); will then give you the "real" IP of the visitor. In nginx you'd whitelist Cloudflare's IPs in the nginx.conf file using set_real_ip_from XXX for each of Cloudflare's IP ranges.

Without the web sever level fix I used:

if ($ip=='') $ip = $_SERVER['HTTP_CF_CONNECTING_IP'];

When I had fixed the IP logging issue at the web server level I used:

if ($ip=='') $ip = $_SERVER['REMOTE_ADDR'];