PHP $_SERVER['REMOTE_ADDR'] no longer giving users ipaddress as expected? - php

Before PHP 5.4 when running retrieving the users IPAddress using $_SERVER['REMOTE_ADDR'] the result would be the users external IPV6 IPAddress.
EG: 60.123.456.168
However since updating my server to PHP 5.4 the returned users IPAddress seems to be their internal IP:
EG: 192.168.1.34
This becomes an issue if you want a specific office or 'router' to see a particular group of content or in our case debug code.
I tried using the other IP option $_SERVER['HTTP_X_FORWARDED_FOR'] but this isn't available on all servers.
Is their another way to grab the users external ipaddress in PHP >= 5.4 or has this functionality been removed?

this even checks for proxy servers and still reveal correct user ip
<?php
function get_real_ip()
{
if (isset($_SERVER["HTTP_CLIENT_IP"]))
{
return $_SERVER["HTTP_CLIENT_IP"];
}
elseif (isset($_SERVER["HTTP_X_FORWARDED_FOR"]))
{
return $_SERVER["HTTP_X_FORWARDED_FOR"];
}
elseif (isset($_SERVER["HTTP_X_FORWARDED"]))
{
return $_SERVER["HTTP_X_FORWARDED"];
}
elseif (isset($_SERVER["HTTP_FORWARDED_FOR"]))
{
return $_SERVER["HTTP_FORWARDED_FOR"];
}
elseif (isset($_SERVER["HTTP_FORWARDED"]))
{
return $_SERVER["HTTP_FORWARDED"];
}
else
{
return $_SERVER["REMOTE_ADDR"];
}
}
$IP_Address = get_real_ip();
echo $IP_Address
?>

It is not PHP's fault. PHP doesn't detect anything but just reading environment variable.
You have some proxy probably, that is not properly configured.

Ok,
Figured out this issue appears to be due to our Newb server setup.
As the server was in fact running from a localhost and networked through Windows (I wasn't aware it was till now).
This explains why the Local IPAddress was coming up.
False alarm :)
Thanks everyone for your help though!

Related

php currency setting based on user location

I need to change currency based on user location. This is my code
<?php
$ipaddress = $_SERVER['REMOTE_ADDR'];
$location = unserialize( file_get_contents('http://www.geoplugin.net/php.gp?ip=' . $_SERVER['REMOTE_ADDR']) );
if($location["geoplugin_countryCode"] === "US")
{
// block to set us currency
}
else{
// user can choose their own currency from array (excluding us)
}
?>
I uploaded it on a server, and to check if the functionality works correctly or not and I used different vpn chrome extension. The problem is all the time else part is alone gets executed even when I choose us as vpn server. I don't know What is causing this problem.
Most probably the issue is that you use $_SERVER['REMOTE_ADDR'].
If you are using a proxy, you should use $_SERVER['HTTP_X_FORWARDED_FOR']

Tor request detection with PHP does not work with domain, but with IP

I use this library: https://stackoverflow.com/a/37973763/1579327
If I request the page directly with the serverip it works but if I call the page via the domain it does not work. :/
I have installed mod_remoteip, so the server recognizes the real IP.
I also have a PHP script, which gives me the "real" IP as a log (via $_SERVER['REMOTE_ADDR']).
The IP that the server recognizes matches the exitnode IP, but why are Tor sessions not recognized by the domain? (The traffic goes through CLoudflare)
<?php
use Dapphp\TorUtils\TorDNSEL;
require_once 'src/TorDNSEL.php';
try {
$isTor = TorDNSEL::IpPort(
$_SERVER['SERVER_ADDR'],
$_SERVER['SERVER_PORT'],
$_SERVER['REMOTE_ADDR']
);
if ($isTor) {
echo '<script>window.sessionStorage.setItem("torsession", true)</script>';
}
} catch (\Exception $ex) {
echo $ex->getMessage() . "\n";
}
?>
The configuration for mod_remoteip may not be set up correctly for Cloudflare. Since it works fine when you bypass CF, $_SERVER['REMOTE_ADDR'] is correct, but appears to be wrong when accessed by the domain.
Here's PHP code you can use that is specific to Cloudflare for detecting the real IP. DO NOT use this code unless your site uses Cloudflare (or set $usingCloudflare = false), otherwise someone can spoof the headers and falsify their IP.
If you use this, you won't need mod_remoteip, but may still want it for other places.
// detect the user's IP from Cloudflare headers, or $_SERVER globals
$usingCloudflare = true; // set to false if not using, otherwise IP can be spoofed
$isCfRequest = $usingCloudflare
&& !empty($_SERVER['HTTP_CF_CONNECTING_IP']);
if ($isCfRequest) {
$remote_addr = $_SERVER['HTTP_CF_CONNECTING_IP'];
} else {
$remote_addr = $_SERVER['REMOTE_ADDR'];
}
// $remote_addr is the Cloudflare-aware client IP
// Practical TorDNSEL usage on a web server:
try {
if (TorDNSEL::isTor($remote_addr)) {
// do something special for Tor users
} else {
// not using Tor, educate them! :-D
}
} catch (\Exception $ex) {
error_log("Tor DNSEL query failed: " . $ex->getMessage());
}

$_SERVER['remote_addr'] returns a private ip address

I have a subscription to a pro offer at OVH. I think that the php environment isn't well configured because when I try to request the client IP with the environment it returns a private IP such as 10.X.X.X wich changes every refreshing.
I tried to print the entire environment to see if the public IP is stored anywhere else, but it is not.
Have you got any ideas where it might comes from ?
Thanks.
seems like you are testing from your localhost. On your live server, the ip address should be properly displayed. Here is a simple function to further assist you:
function getUserIpAddress() {
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_CLIENT_IP'];
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
$ip = $_SERVER['REMOTE_ADDR'];
}
return $ip;
}

How do I get the external IP of my server using PHP?

I often hear people say to use "$_SERVER['SERVER_ADDR']", but that returns the LAN IP of my server (e.g. 192.168.1.100). I want the external IP.
There is NO way to get your underlying IP Address that has been designated by your ISP via conventional PHP if you are using a router. A way to get the external IP is to find a service that will obtain it for you and echo the address back to you. I found a handy service which does just that. http://ipecho.net/
You can use:
$realIP = file_get_contents("http://ipecho.net/plain");
Just query a host that returns your IP address:
$externalContent = file_get_contents('http://checkip.dyndns.com/');
preg_match('/Current IP Address: \[?([:.0-9a-fA-F]+)\]?/', $externalContent, $m);
$externalIp = $m[1];
or, set up a service that simply echoes just the IP, and use it like this:
$externalIp = file_get_contents('http://yourdomain.example/ip/');
Set up the service yourself by simply echoing the remote IP address, or pay someone to host it. Do not use somebody else's server without permission. Previously, this answer linked to a service of mine that's now being hit multiple times a second.
Note that in an IP network with one or more NATs, you may have multiple external IP addresses. This will give you just one of them.
Also, this solution of course depends on the remote host being available. However, since there is no widely implemented standard (no ISP and only some home routers implement UPnP), there is no other way to get your external IP address. Even if you could talk to your local NAT, you couldn't be sure that there isn't another NAT behind it.
I'm going to add a solution because the others weren't quite right for me because they:
need to be run on a server with a domain name e.g. gethostbyname() (if you think about it, you don't actually have the problem if you know this a priori)
can't be used on the CLI (rely on something in $_SERVER to be set by a web server)
assume a specific format of ifconfig output, which can include multiple non-public interfaces
depend on parsing someone's website (who may disappear, change the URL, change the format, start lying to you, etc, all without notice)
This is what I would suggest:
$sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
$res = socket_connect($sock, '8.8.8.8', 53);
// You might want error checking code here based on the value of $res
socket_getsockname($sock, $addr);
socket_shutdown($sock);
socket_close($sock);
echo $addr; // Ta-da! The IP address you're connecting from
The IP address there is a Google public DNS server. I trust they'll be around and running it for a while. It shouldn't really matter what address you use there as long as its a public IP address that belongs to someone who doesn't mind random connection attempts too much (yourself maybe?).
This is based on an answer I came across when I had a similar problem in Python.
P.S.: I'm not sure how well the above would work if there is sorcery going on between your machine and the internet.
You could parse it from a service like ip6.me:
<?php
// Pull contents from ip6.me
$file = file_get_contents('http://ip6.me/');
// Trim IP based on HTML formatting
$pos = strpos( $file, '+3' ) + 3;
$ip = substr( $file, $pos, strlen( $file ) );
// Trim IP based on HTML formatting
$pos = strpos( $ip, '</' );
$ip = substr( $ip, 0, $pos );
// Output the IP address of your box
echo "My IP address is $ip";
// Debug only -- all lines following can be removed
echo "\r\n<br/>\r\n<br/>Full results from ip6.me:\r\n<br/>";
echo $file;
You could try this:
$ip = gethostbyname('www.example.com');
echo $ip;
to get the IP address associated with your domain name.
I know this question is old and long answered, but I was googling for the same thing and want to add my own "hack". For this to work your webrequest has to come from an external IP address or you have to alter $own_url to a url that does an external request to itself.
The point is, if you let the script do a request to itself than you get it's external IP address.
<?php
if (isset($_GET['ip'])) {
die($_SERVER['REMOTE_ADDR']);
}
$own_url = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://'.$_SERVER['HTTP_HOST'].$_SERVER['SCRIPT_NAME'];
$ExternalIP = file_get_contents($own_url.'?ip=1');
echo $ExternalIP;
?>
I think there is much code for this things in others answers, but my answer is short, but you need to execute a command in shell to get the ip...
but it is short and fast, I think that...
php execute bash > bash run > bash get ip > php get ip
echo shell_exec( "dig +short myip.opendns.com #resolver1.opendns.com");
Sorry my for my english, I hope it help all you...
Reference: How can I get my external IP address in a shell script?
This is an old thread, but for what it's worth, I'm adding a simple function that I use. It uses outside services (which is inevitable it seems), but it provides a backup service as well, and local caching to avoid repetitive HTTP calls.
/*
USAGE
$ip = this_servers_public_ip(); // Get public IP, and store it locally for subsequent calls.
$ip = this_servers_public_ip(true); // Force remote query and refresh local cache if exists.
*/
function this_servers_public_ip($purge=false) {
$local = sys_get_temp_dir().'/this.servers.public.ip';
if ( $purge===true && realpath($local) ) {
unlink($local);
}
if ( realpath($local) ) {
return file_get_contents($local);
}
// Primary IP checker query.
$ip = trim( file_get_contents('https://checkip.amazonaws.com') );
if ( (filter_var($ip, FILTER_VALIDATE_IP) !== false) ) {
file_put_contents($local,$ip);
return $ip;
}
// Secondary IP checker query.
$ip_json = trim( file_get_contents('https://ipinfo.io/json') );
$ip_arr = json_decode($ip_json,true);
$ip=$ip_arr['ip'];
if ( (filter_var($ip, FILTER_VALIDATE_IP) !== false) ) {
file_put_contents($local,$ip);
return $ip;
}
return false; // Something went terribly wrong.
}
If your server have a domain name you can ping it or you can use:
$sMyServerIP = gethostbyname('yourdomain.com');
echo $sMyServerIP;
It will return your outer IP address.
Assuming your PHP is running on a Linux server you can call ifconfig using PHP's exec function. This will give public IP without need to contact some external website/service. E.g.:
$command = "ifconfig"; /// see notes below
$interface = "eth0"; //
exec($command, $output);
$output = implode("\n",$output);
if ( preg_match('/'.preg_quote($interface).'(.+?)[\r\n]{2,}/s', $output, $ifaddrsMatch)
&& preg_match_all('/inet(6)? addr\s*\:\s*([a-z0-9\.\:\/]+)/is', $ifaddrsMatch[1], $ipMatches, PREG_SET_ORDER) )
{
foreach ( $ipMatches as $ipMatch )
echo 'public IPv'.($ipMatch[1]==6?'6':'4').': '.$ipMatch[2].'<br>';
}
Note that sometimes as $command you have to specify full path of ifconfig. You can find this by executing
whereis ifconfig
from shell prompt. Furthermore $interface should be set to the name of your server's main network interface that has the link to the WAN.
On Windows you can do something similar of course, using ipconfig instead of ifconfig (and corresponding adjusted regex).
Also you could get IP via DNS A record based on hostname or server name:
$dnsARecord = dns_get_record($_SERVER['HTTP_HOST'],DNS_A);
if ( $dnsARecord ) echo 'IPv4: '.$dnsARecord[0]['ip'];
$dnsARecord = dns_get_record($_SERVER['HTTP_HOST'],DNS_AAAA);
if ( $dnsARecord ) echo 'IPv6: '.$dnsARecord[0]['ip'];
You could also use SERVER_NAME instead of HTTP_HOST if one of the two does not give what you want.
However, this is assuming that your server is configured correctly in correspondence with DNS. This may not always be the case. See my other answer using ifconfig that is perhaps better.
Have you tried:
gethostbyname(php_uname('n'));
?

Testing user HTTP proxy using PHP script

Welcome,
I'm writing application what will allow me to try detect what type of HTTP proxy user have installed.
Script calling remote server adding parameter http://xxxx.php?my_ip=real_IP
Here is my application:
<?php
/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
$real_ip=$_GET['my_ip'];
$ip1=$_SERVER['HTTP_X_FORWARDED_FOR'];
$ip2=$_SERVER['HTTP_X_FORWARDED'];
$ip3=$_SERVER['HTTP_FORWARDED_FOR'];
$ip4=$_SERVER['HTTP_CLIENT_IP'];
$ip5=$_SERVER['HTTP_VIA'];
$ip6=$_SERVER['REMOTE_ADDR'];
$ip_array[1]=$ip1;
$ip_array[2]=$ip2;
$ip_array[3]=$ip3;
$ip_array[4]=$ip4;
$ip_array[5]=$ip5;
if($ip6==$real_ip)
{
echo "You are not using proxy.";
}
else
{
if(in_array($real_ip, $ip_array))
{
echo "You are using transparent proxy with one releave your ip.";
}
else
{
if( $_SERVER['HTTP_X_FORWARDED_FOR']
|| $_SERVER['HTTP_X_FORWARDED']
|| $_SERVER['HTTP_FORWARDED_FOR']
|| $_SERVER['HTTP_CLIENT_IP']
|| $_SERVER['HTTP_VIA'])
{
echo "You are using anonymous proxy with one protect Your IP but inform www servers about using proxy";
}
else
{
echo "You are using elite proxy, with one hide your IP and don't inform www servers about using proxy";
}
}
}
$table=<<<table
<p>Ip HTTP_X_FORWARDED_FOR FOR : $ip1</p>
<p>Ip HTTP_X_FORWARDED : $ip2</p>
<p>Ip HTTP_FORWARDED_FOR FOR : $ip3</p>
<p>Ip HTTP_CLIENT_IP FOR : $ip4</p>
<p>Ip HTTP_VIA FOR : $ip5</p>
<p>Ip remote addr : $ip6</p>
table;
echo $table;
?>
I run some tests and application looks working very well.
If you have any tips please tell me.
I mean i would like know am i dont miss something important.
Regards
Another way in which some major players (Paypal, eBay, sites that have high security etc) find proxies is by looking up your IP's hostname with gethostbyaddr() which can reveal a source that is likely to be a proxy E.g. server.squid.com (Very obvious example to show you what I mean!)

Categories