What is the IP address source?

An application behind a reverse proxy may see only the proxy's TCP address. A managed proxy can pass the original connection information in headers such as Forwarded, X-Forwarded-For, or X-Real-IP.

How NetKarte uses it

Read Source in the top IP card of Network diagnostics, then compare the same header's row under Forwarding headers in the HTTP information card. The values appear automatically when you open diagnostics; you do not need to enter an IP or header. This compares a received raw header with the source selected for the displayed IP.

Only when the trusted setting TRUST_PROXY_HEADERS=true is enabled, NetKarte searches for a valid address in Forwarded, X-Forwarded-For, then X-Real-IP. “Source” identifies the header from which the displayed IP was selected.

How to read the value

X-Forwarded-For means the displayed address was taken from the first valid candidate in that header. Forwarded means its standard for parameter was used. This explains the origin of the value; it does not identify the proxy type or safety.

Notes

Forwarding headers can be spoofed. NetKarte assumes that the managed proxy removes or overwrites untrusted internet values. Ordinary header values must never be treated as the “real IP” without a defined trust boundary.

When several headers exist

Suppose, illustratively, Forwarded contains a valid IP and X-Forwarded-For contains a different one. NetKarte currently prefers Forwarded; a visible header is not necessarily the selected source.

Read Source first, then compare the corresponding HTTP header. Disabled trust or no usable candidate produces an unavailable IP, not a diagnosis of a disconnected line. Administrators should inspect the forwarding path and removal of untrusted incoming headers. Adding a header in your browser is not a fix.