--- title: "Getting the Real Client IP in a .NET Core App Behind frpc Intranet Tunneling" description: "Explains why X-Forwarded-For doesn't work for real IP retrieval in frpc HTTPS mode, and how to forward requests through Nginx with Proxy Protocol v2 enabled to get the true client IP." canonical_url: "https://blog.markkulab.net/en/post/get-real-ip-from-frpc" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2022-01-23 01:01:01 +0800" category: ".NET Core" tags: ["frp", "frpc", "reverse proxy", "real ip", "proxy protocol", "nginx", "dotnet", "network"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # Getting the Real Client IP in a .NET Core App Behind frpc Intranet Tunneling ## The Problem Large-scale web architectures typically use a load balancer or reverse proxy, and the client IP is usually obtained via the `X-Forwarded-For` header. However, frpc's HTTPS mode can only expose the real client IP through the Proxy Protocol — and Microsoft's web server (Kestrel) does not natively support that protocol. You therefore need Nginx as a middle layer to extract the real client IP. ## What Is Proxy Protocol? When Proxy Protocol is enabled, frpc sends a Proxy Protocol header to the local service immediately after establishing a connection. The local service parses this header to obtain the visitor's real IP. This works for any TCP service that supports the protocol — not just HTTP. Traditional reverse proxies pass the client IP via the `X-Forwarded-For` HTTP header, which can be spoofed by a malicious client. Proxy Protocol, on the other hand, captures the IP at the TCP/IP handshake level, making it tamper-resistant and more secure. ## Ways frpc Can Obtain the Client IP 1. **HTTP (unencrypted)** — the real client IP can be read from `X-Forwarded-For`. 2. **HTTPS** — you must use the Proxy Protocol at the transport layer to obtain the real client IP. ## Step 1: Edit frpc.ini and Set proxy_protocol_version to v2 ``` [common] server_addr = your public frps url server_port = 7000 auth_token = you token pool_count = 10000 proxy_protocol_version = v2 [web] type = https local_port = 443 custom_domains = www.markkulab.net proxy_protocol_version = v2 ``` ## Step 2: Configure nginx.conf ``` upstream frp { server 34.80.106.95:80; # 这个是frp_server的内网ip和http监听端口 } server { listen 80; server_name www.letgo.com.tw; server_tokens off; location /.well-known/acme-challenge/ { root /var/www/certbot; } location / { return 301 https://$host$request_uri; } } server { listen 80 proxy_protocol; listen 443 ssl http2 proxy_protocol; listen [::]:443 ssl http2; server_name www.letgo.com.tw; # local server ip set_real_ip_from 172.31.0.1; # frp client ip real_ip_recursive on; real_ip_header proxy_protocol; ssl_certificate /etc/letsencrypt/live/www.letgo.com.tw/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/www.letgo.com.tw/privkey.pem; ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; add_header Strict-Transport-Security "max-age=31536000"; error_page 497 https://$host$request_uri; location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_protocol_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://192.168.50.52:8890/; # your local application ip } } ``` ## Step 3: Read the Client IP from the X-Forwarded-For Header in Your App ``` public static string GetUserIp(this HttpContext context) { var ip = context.Request.Headers["X-Forwarded-For"].FirstOrDefault(); if (!string.IsNullOrWhiteSpace(ip)) { ip = ip.Replace("::ffff:", ""); } return ip; } ``` ## References [Reference 1](https://www.fenghong.tech/blog/ops/frp-get-realip/) --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/post/get-real-ip-from-frpc) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software Solution Provider - 10+ years senior software engineer, now an AI Builder - Focused on large-platform architecture — North-American e-commerce, AI SaaS subscription billing - Combining AI Agents and automation to build evolvable product foundations ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer and compare/sync, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Kafka message browsing with monitoring & alerts, a bilingual UI (Traditional Chinese / English), a built-in AI assistant (natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [Special Education](https://blog.markkulab.net/en/education): Learning materials crafted for special education students ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物週報](https://blog.markkulab.net/en/category/open-source-weekly): A weekly two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.