在有多个代理服务器的情况下，会将代理服务器的X-Forwarded-For头部的ip地址和客户端的ip地址相加，即:X-Forwarded-For请求头部header的ip字符串  + 直接向nginx服务器发送请求的客户端地址换个表达请求的过程是client--->nginx1--->nginx2---->tomcat而假设client：ip1, nginx1:ip2, nginx2:ip3, tomcat:ip4那么请求request到tomcat时，请求头部header中的X-Forwarded-For信息是=ip1,ip2,ip3

简单了方法

public String getIpAddr(HttpServletRequest request) {String ip = request.getHeader("x-forwarded-for");if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {ip = request.getHeader("Proxy-Client-IP");}if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {ip = request.getHeader("WL-Proxy-Client-IP");}if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {ip = request.getRemoteAddr();}return ip;
}

上面三个请求头，大部分的代理或者网关都会加上x-forwarded-for：clientip,proxy1ip,proxy2ip

Proxy-Client-IP这个一般是apache，http服务器才会有，经过apache代理时，apache会在请求头加上x-forwarded-for和Proxy-Client-IP

WL-Proxy-Client-IP这个一般是weblogic才会加上的头部

注意：

1、这些请求头都不是http协议里的标准请求头，也就是说这个是各个代理服务器自己规定的表示客户端地址的请求头。如果哪天有一个代理服务器软件用oooo-client-ip这个请求头代表客户端请求，那上面的代码就不行了。

2、这些请求头不是代理服务器一定会带上的，网络上的很多匿名代理就没有这些请求头，所以获取到的客户端ip不一定是真实的客户端ip。代理服务器一般都可以自定义请求头设置。

3、即使请求经过的代理都会按自己的规范附上代理请求头，上面的代码也不能确保获得的一定是客户端ip。不同的网络架构，判断请求头的顺序是不一样的。

4、最重要的一点，请求头都是可以伪造的。如果一些对客户端校验较严格的应用（比如投票）要获取客户端ip，应该直接使用ip = request.getRemoteAddr ()，虽然获取到的可能是代理的ip而不是客户端的ip，但这个获取到的ip基本上是不可能伪造的，也就杜绝了刷票的可能。(有分析说arp欺骗+syn有可能伪造此ip，如果真的可以，这是所有基于TCP协议都存在的漏洞)，这个ip是tcp连接里的ip。
IP工具类 import javax.servlet.http.HttpServletRequest; /** * IP地址工具类 * @author xudongdong * */ public class IpUtil {

/*** 私有化构造器*/
private IpUtil() {
}
/*** 获取真实IP地址* <p>使用getRealIP代替该方法</p>* @param request req* @return ip*/
@Deprecated
public static String getClinetIpByReq(HttpServletRequest request) {// 获取客户端ip地址String clientIp = request.getHeader("x-forwarded-for");if (clientIp == null || clientIp.length() == 0 || "unknown".equalsIgnoreCase(clientIp)) {clientIp = request.getHeader("Proxy-Client-IP");}if (clientIp == null || clientIp.length() == 0 || "unknown".equalsIgnoreCase(clientIp)) {clientIp = request.getHeader("WL-Proxy-Client-IP");}if (clientIp == null || clientIp.length() == 0 || "unknown".equalsIgnoreCase(clientIp)) {clientIp = request.getRemoteAddr();}/** 对于获取到多ip的情况下，找到公网ip.*/String sIP = null;if (clientIp != null && !clientIp.contains("unknown") && clientIp.indexOf(",") > 0) {String[] ipsz = clientIp.split(",");for (String anIpsz : ipsz) {if (!isInnerIP(anIpsz.trim())) {sIP = anIpsz.trim();break;}}/** 如果多ip都是内网ip，则取第一个ip.*/if (null == sIP) {sIP = ipsz[0].trim();}clientIp = sIP;}if (clientIp != null && clientIp.contains("unknown")){clientIp =clientIp.replaceAll("unknown,", "");clientIp = clientIp.trim();}if ("".equals(clientIp) || null == clientIp){clientIp = "127.0.0.1";}return clientIp;
}/*** 判断IP是否是内网地址* @param ipAddress ip地址* @return 是否是内网地址*/
public static boolean isInnerIP(String ipAddress) {boolean isInnerIp;long ipNum = getIpNum(ipAddress);/**   私有IP：A类  10.0.0.0-10.255.255.255   B类  172.16.0.0-172.31.255.255   C类  192.168.0.0-192.168.255.255   当然，还有127这个网段是环回地址   **/long aBegin = getIpNum("10.0.0.0");long aEnd = getIpNum("10.255.255.255");long bBegin = getIpNum("172.16.0.0");long bEnd = getIpNum("172.31.255.255");long cBegin = getIpNum("192.168.0.0");long cEnd = getIpNum("192.168.255.255");isInnerIp = isInner(ipNum, aBegin, aEnd) || isInner(ipNum, bBegin, bEnd) || isInner(ipNum, cBegin, cEnd)|| ipAddress.equals("127.0.0.1");return isInnerIp;
}
private static long getIpNum(String ipAddress) {String[] ip = ipAddress.split("\\.");long a = Integer.parseInt(ip[0]);long b = Integer.parseInt(ip[1]);long c = Integer.parseInt(ip[2]);long d = Integer.parseInt(ip[3]);return a * 256 * 256 * 256 + b * 256 * 256 + c * 256 + d;
}private static boolean isInner(long userIp, long begin, long end) {return (userIp >= begin) && (userIp <= end);
}
public static String getRealIP(HttpServletRequest request){// 获取客户端ip地址String clientIp = request.getHeader("x-forwarded-for");if (clientIp == null || clientIp.length() == 0 || "unknown".equalsIgnoreCase(clientIp)) {clientIp = request.getRemoteAddr();}String[] clientIps = clientIp.split(",");if(clientIps.length <= 1) return clientIp.trim();// 判断是否来自CDNif(isComefromCDN(request)){if(clientIps.length>=2) return clientIps[clientIps.length-2].trim();}return clientIps[clientIps.length-1].trim();
}
private static boolean isComefromCDN(HttpServletRequest request) {String host = request.getHeader("host");return host.contains("www.189.cn") ||host.contains("shouji.189.cn") || host.contains("image2.chinatelecom-ec.com") || host.contains("image1.chinatelecom-ec.com");
}