Page MenuHomePhabricator

Allow blocking private (internal) IPs passed by X-Forwarded-For
Open, MediumPublicFeature


This is an import of the feature request at

Some proxies pass an X-Forwarded-For header with an internal IP as value. If we could block the combination of internal and external (e.g. via, that would allow us to target particular computers without blocking the whole proxy.

There are several known proxies this applies to (listed at URL above), and probably many more unknown. Several are schools. Those alone would provide a significant benefit,

Version: unspecified
Severity: enhancement
See Also:



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 12:16 AM
bzimport set Reference to bz34288.
bzimport added a subscriber: Unknown Object (MLST).

Jasper Deng noted at bug 23343 that this feature could also be useful for [[carrier-grade NAT]]:

"I'd like to add (from the above dup) that it would be useful, especially for
networks using carrier-grade NAT, that we should be able to also base blocks
off of both public-facing and (private) IPs behind, such as blocking
"" or ""."

Aklapper changed the subtype of this task from "Task" to "Feature Request".Feb 4 2022, 12:24 PM