Public IP detection problem

Hey everyone,

I just launched my 'What is my IP Address' web tool, and while it mostly works as expected, I'm running into a frustrating issue with accurate client IP address detection for some users. It's a fundamental part of the tool, so getting it right is crucial.

The problem is that the tool occasionally displays an incorrect IP address, often an internal proxy IP or a CDN's IP, instead of the user's actual public IP. This seems to happen more frequently with users behind corporate networks, VPNs, or specific ISPs, which is really impacting the reliability I want to offer.

Here's what I've tried so far:

• Initially relied on REMOTE_ADDR and checked for X-Forwarded-For and X-Real-IP headers.
• Implemented a fallback to external IP lookup APIs (like ipify.org) but want to minimize external dependencies for speed and reliability, as well as potential rate limits.
• Analyzed server access logs, and I can see REMOTE_ADDR often showing an internal IP while the true user IP might be buried in X-Forwarded-For, sometimes with multiple hops.
• Tried different Nginx configurations to ensure proxy_set_header X-Real-IP $remote_addr; and proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; are correctly set, thinking it might be a server configuration issue.

For instance, here's a dummy server log snippet illustrating the problem:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
REMOTE_ADDR: 172.16.0.10 (Internal Proxy)
X-Forwarded-For: 192.168.1.50, 203.0.113.45 (Actual Public IP)
Expected IP: 203.0.113.45
Tool Detected IP: 172.16.0.10

As you can see, REMOTE_ADDR is the internal proxy, and the actual public IP is the last one in X-Forwarded-For. My tool needs to reliably extract that final public IP.

My specific questions are:

• What's the most robust, server-side method for accurately determining a user's true public client IP address, considering various proxy/CDN setups?
• Are there any common pitfalls or specific Nginx/Apache configurations I should be aware of to ensure the correct IP is always passed to my application?
• Any recommended open-source libraries or logic patterns for parsing X-Forwarded-For headers reliably, especially with multiple entries, to get the actual user IP?

Really hoping some experienced developers here can share their insights on handling this common but tricky problem. Waiting for an expert reply!