Hide my real ip address when i'm surfing a php page

Question

Hi , This php function return the real ip address of clients :

function getRealIpAddr()
{
    if (!empty($_SERVER['HTTP_CLIENT_IP']))   //check ip from share internet
    {
      $ip=$_SERVER['HTTP_CLIENT_IP'];
    }
    elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))   //to check ip is pass from proxy
    {
      $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
    }
    else
    {
      $ip=$_SERVER['REMOTE_ADDR'];
    }
    return $ip;
}

when i set a ip:port proxy for IE , this code still show my real ip and i don't know how can i hide my ip from this php code !!! (such as VPN mechanism)

Answer 1

What about using CURL and curl_setopt() with this option - CURLOPT_INTERFACE.

but this will not return data back to you and instead to the new IP address set.

Answer 2

This is not your fault. If you want to hide your real IP, you must find a real anonymous proxy (also called 'elite'). You can't change http headers to fake your ip - those headers (HTTP_X_FORWARDED_FOR in fact) are added on the fly by transparent proxy server.

When connecting by non-elite but normal anonymous proxy, there will be only one header saying that connection is forwarded, but will not reveal your real IP.

You can also use SOCKS proxy, which do not modify http headers, because they don't have specified protocol, only mediate in TCP connection.

Some proxies can send your IP in own-non-standard headers. If you want to be sure, that your IP is not given anywhere, you should write your own tester, which will parse all headers to find your exact IP.

Also remember, that not every proxy is safe, some of them could be setted up by hackers to catch a password, or changing your data on the fly.

Answer 3

All headers are forgable by clients. The end point of the socket is not forgable - but with facilities like tor you cannot rely on the data being in anyway accurate, never mind NAT.

Whatever you are trying to achieve, you should not rely on the information returned by the function. The only place where you should use it all is for indicative information across a large sample size (e.g. for GIS ip/address lookups).

You should certainly never, ever use this for authentication purposes.