X-Forwarded-For Client IP Resolver
Work out the real client IP from an X-Forwarded-For header and your trusted proxies, and get matching Nginx real_ip and Laravel TrustProxies settings.
Free · No sign-up · Your inputs stay in your browser
Input
Work out the real client IP from X-Forwarded-For
Output
198.51.100.7
| Step | Address | Source | Verdict |
|---|---|---|---|
| 1 | 10.0.0.5 | connection (REMOTE_ADDR) | trusted proxy, keep walking |
| 2 | 172.70.12.9 | X-Forwarded-For | trusted proxy, keep walking |
| 3 | 198.51.100.7 | X-Forwarded-For | first untrusted address: the client |
Leftmost entry (spoofable)
1.2.3.4
Differs from the safe answer: a client wrote it.
Nginx
set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.64.0.0/13; real_ip_header X-Forwarded-For; real_ip_recursive on;
Laravel (bootstrap/app.php)
->withMiddleware(function (Middleware $middleware) { $middleware->trustProxies(at: ['10.0.0.0/8', '172.64.0.0/13']); })
Each proxy appends the address it received the request from, so only the entries added by your own proxies can be believed. The safe algorithm walks the list from the right, skipping trusted proxies, and stops at the first address it does not trust. Taking the leftmost entry lets any client choose its own IP by sending the header itself.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Why the leftmost entry is wrong
Any client can send its own X-Forwarded-For header, and each proxy appends to whatever arrived. The leftmost value is therefore whatever the client chose, and code that trusts it lets an attacker pick their IP for rate limiting, audit logs and allow lists. Only entries added by your own proxies can be believed, which is the right-to-left algorithm. RFC 7239 standardises the newer Forwarded header with the same caveat.
Configure it once, at the edge
Nginx's realip module with real_ip_recursive on and Laravel's trustProxies apply exactly this algorithm. Get the trusted list right (load balancer subnets, CDN ranges) and the application can use the client IP without parsing headers itself.