当客户端通过单元格连接时，远程IP地址会有所不同

Question

I am building a solution in php which requires me to accurately know the ip of the requestor. For most cases, the classic call to

$ip = $_SERVER['REMOTE_HOST'];

works just fine.

However, I've noted that in the case where the client is making their request over a tethered connection, I get a completely different address than what google and my firewall report.

I can verify this on the client (tethered) side by searching for "my ip" on google which gives me an IP that matches what my server's firewall is reporting as well. Neither of these match what the $_SERVER['REMOTE_HOST'] contains on the server side though.

My questions then are:

• Why do these addresses differ in general?
• How do I get to the ip address that my firewall and google see, specifically using php?

Answer 1

Huh, turns out this was being done using a javascript "feature" (what I'd think about calling a vulnerability instead) all along. Scary stuff, as it also exposes your internal IP address as well. Anyway it's something called WebRTC, that just started getting a lot of attention this week as it's been officially implemented by firefox and chrome:

//get the IP addresses associated with an account
function getIPs(callback){
    var ip_dups = {};

    //compatibility for firefox and chrome
    var RTCPeerConnection = window.RTCPeerConnection
        || window.mozRTCPeerConnection
        || window.webkitRTCPeerConnection;
    var mediaConstraints = {
        optional: [{RtpDataChannels: true}]
    };

    //firefox already has a default stun server in about:config
    //    media.peerconnection.default_iceservers =
    //    [{"url": "stun:stun.services.mozilla.com"}]
    var servers = undefined;

    //add same stun server for chrome
    if(window.webkitRTCPeerConnection)
        servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]};

    //construct a new RTCPeerConnection
    var pc = new RTCPeerConnection(servers, mediaConstraints);

    //listen for candidate events
    pc.onicecandidate = function(ice){

        //skip non-candidate events
        if(ice.candidate){

            //match just the IP address
            var ip_regex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/
            var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];

            //remove duplicates
            if(ip_dups[ip_addr] === undefined)
                callback(ip_addr);

            ip_dups[ip_addr] = true;
        }
    };

    //create a bogus data channel
    pc.createDataChannel("");

    //create an offer sdp
    pc.createOffer(function(result){

        //trigger the stun server request
        pc.setLocalDescription(result, function(){});

    }, function(){});
}

//Test: Print the IP addresses into the console
getIPs(function(ip){console.log(ip);});

Source: https://github.com/diafygi/webrtc-ips

Demo: https://diafygi.github.io/webrtc-ips/