到目前为止，所有的响应都考虑了非标准化但非常常见的X-Forwarded-For报头。有一个标准化的转发头，它有点难以解析。一些例子如下:

Forwarded: for="_gazonk"
Forwarded: For="[2001:db8:cafe::17]:4711"
Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43
Forwarded: for=192.0.2.43, for=198.51.100.17

我已经编写了一个类，在确定客户端的IP地址时考虑这两个头。

using System;
using System.Web;

namespace Util
{
    public static class IP
    {
        public static string GetIPAddress()
        {
            return GetIPAddress(new HttpRequestWrapper(HttpContext.Current.Request));
        }

        internal static string GetIPAddress(HttpRequestBase request)
        {
            // handle standardized 'Forwarded' header
            string forwarded = request.Headers["Forwarded"];
            if (!String.IsNullOrEmpty(forwarded))
            {
                foreach (string segment in forwarded.Split(',')[0].Split(';'))
                {
                    string[] pair = segment.Trim().Split('=');
                    if (pair.Length == 2 && pair[0].Equals("for", StringComparison.OrdinalIgnoreCase))
                    {
                        string ip = pair[1].Trim('"');

                        // IPv6 addresses are always enclosed in square brackets
                        int left = ip.IndexOf('['), right = ip.IndexOf(']');
                        if (left == 0 && right > 0)
                        {
                            return ip.Substring(1, right - 1);
                        }

                        // strip port of IPv4 addresses
                        int colon = ip.IndexOf(':');
                        if (colon != -1)
                        {
                            return ip.Substring(0, colon);
                        }

                        // this will return IPv4, "unknown", and obfuscated addresses
                        return ip;
                    }
                }
            }

            // handle non-standardized 'X-Forwarded-For' header
            string xForwardedFor = request.Headers["X-Forwarded-For"];
            if (!String.IsNullOrEmpty(xForwardedFor))
            {
                return xForwardedFor.Split(',')[0];
            }

            return request.UserHostAddress;
        }
    }
}

下面是我用来验证我的解决方案的一些单元测试:

using System.Collections.Specialized;
using System.Web;
using Microsoft.VisualStudio.TestTools.UnitTesting;

namespace UtilTests
{
    [TestClass]
    public class IPTests
    {
        [TestMethod]
        public void TestForwardedObfuscated()
        {
            var request = new HttpRequestMock("for=\"_gazonk\"");
            Assert.AreEqual("_gazonk", Util.IP.GetIPAddress(request));
        }

        [TestMethod]
        public void TestForwardedIPv6()
        {
            var request = new HttpRequestMock("For=\"[2001:db8:cafe::17]:4711\"");
            Assert.AreEqual("2001:db8:cafe::17", Util.IP.GetIPAddress(request));
        }

        [TestMethod]
        public void TestForwardedIPv4()
        {
            var request = new HttpRequestMock("for=192.0.2.60;proto=http;by=203.0.113.43");
            Assert.AreEqual("192.0.2.60", Util.IP.GetIPAddress(request));
        }

        [TestMethod]
        public void TestForwardedIPv4WithPort()
        {
            var request = new HttpRequestMock("for=192.0.2.60:443;proto=http;by=203.0.113.43");
            Assert.AreEqual("192.0.2.60", Util.IP.GetIPAddress(request));
        }

        [TestMethod]
        public void TestForwardedMultiple()
        {
            var request = new HttpRequestMock("for=192.0.2.43, for=198.51.100.17");
            Assert.AreEqual("192.0.2.43", Util.IP.GetIPAddress(request));
        }
    }

    public class HttpRequestMock : HttpRequestBase
    {
        private NameValueCollection headers = new NameValueCollection();

        public HttpRequestMock(string forwarded)
        {
            headers["Forwarded"] = forwarded;
        }

        public override NameValueCollection Headers
        {
            get { return this.headers; }
        }
    }
}

通常你会想知道访问你网站的人的IP地址。而ASP。NET有几种方法可以做到这一点，我们所见过的最好的方法之一是使用ServerVariables集合的“HTTP_X_FORWARDED_FOR”。

这是为什么…

有时，您的访问者位于代理服务器或路由器和标准请求的后面。UserHostAddress仅捕获代理服务器或路由器的IP地址。在这种情况下，用户的IP地址存储在服务器变量(“HTTP_X_FORWARDED_FOR”)中。

所以我们要做的是首先检查“HTTP_X_FORWARDED_FOR”，如果这是空的，我们然后简单地返回ServerVariables(“REMOTE_ADDR”)。

虽然这种方法不是万无一失的，但它可以带来更好的结果。下面是ASP。NET代码在VB。NET，摘自James Crowley的博客文章“Gotcha: HTTP_X_FORWARDED_FOR返回多个IP地址”

C#

protected string GetIPAddress()
{
    System.Web.HttpContext context = System.Web.HttpContext.Current; 
    string ipAddress = context.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];

    if (!string.IsNullOrEmpty(ipAddress))
    {
        string[] addresses = ipAddress.Split(',');
        if (addresses.Length != 0)
        {
            return addresses[0];
        }
    }

    return context.Request.ServerVariables["REMOTE_ADDR"];
}

VB。网

Public Shared Function GetIPAddress() As String
    Dim context As System.Web.HttpContext = System.Web.HttpContext.Current
    Dim sIPAddress As String = context.Request.ServerVariables("HTTP_X_FORWARDED_FOR")
    If String.IsNullOrEmpty(sIPAddress) Then
        Return context.Request.ServerVariables("REMOTE_ADDR")
    Else
        Dim ipArray As String() = sIPAddress.Split(New [Char]() {","c})
        Return ipArray(0)
    End If
End Function

我想我应该和大家分享我的经验。好吧，我看到在某些情况下REMOTE_ADDR将不会得到你正在寻找的东西。例如，如果你在后台有一个负载均衡器，如果你试图获取客户端的IP，那么你就会遇到麻烦。我用我的IP屏蔽软件检查过了，我还和我在不同大洲的同事们检查过了。这就是我的解。

当我想知道一个客户端的IP时，我试图选择每一个可能的证据，这样我就可以确定它们是否唯一:

在这里，我发现了另一个server -var，如果你想获得客户端的确切IP，它可以帮助你。所以我使用:HTTP_X_CLUSTER_CLIENT_IP

HTTP_X_CLUSTER_CLIENT_IP总是得到客户端的确切IP。在任何情况下，如果它不给你的值，你应该然后寻找HTTP_X_FORWARDED_FOR，因为它是第二个最好的候选人，让你的客户端IP，然后REMOTE_ADDR变量，可能或可能不返回你的IP，但对我来说，拥有这三个是我发现最好的东西来监控他们。

我希望这能帮助到一些人。

如果是c#这样看，是很简单的

string clientIp = (Request.ServerVariables["HTTP_X_FORWARDED_FOR"] ?? 
                   Request.ServerVariables["REMOTE_ADDR"]).Split(',')[0].Trim();

就像别人说的，你不可能做到你所要求的。如果你描述一下你想要解决的问题也许有人可以帮你?

如。

您是否试图唯一地标识您的用户? 您是否可以使用cookie或会话ID来代替IP地址?

Edit The address you see on the server shouldn't be the ISP's address, as you say that would be a huge range. The address for a home user on broadband will be the address at their router, so every device inside the house will appear on the outside to be the same, but the router uses NAT to ensure that traffic is routed to each device correctly. For users accessing from an office environment the address may well be the same for all users. Sites that use IP address for ID run the risk of getting it very wrong - the examples you give are good ones and they often fail. For example my office is in the UK, the breakout point (where I "appear" to be on the internet) is in another country where our main IT facility is, so from my office my IP address appears to be not in the UK. For this reason I can't access UK only web content, such as the BBC iPlayer). At any given time there would be hundreds, or even thousands, of people at my company who appear to be accessing the web from the same IP address.

当你在写服务器代码时，你永远不能确定你看到的IP地址指的是什么。一些用户喜欢这种方式。有些人故意使用代理或VPN来进一步混淆你。

当你说你的机器地址与StackOverflow上显示的IP地址不同时，你是如何找到你的机器地址的?如果您只是使用ipconfig或类似的工具在本地查找，我希望由于我上面概述的原因它会有所不同。如果你想再次确认外界的看法，可以看看whatismyipaddress.com/。

这个关于NAT的维基百科链接将为您提供一些背景知识。

它的简单。试一试:

var remoteIpAddress = Request.HttpContext.Connection.RemoteIpAddress;

就这样吧!)