use x-forwarded-for header instead of remote_addr