Prefer HTTP_X_FORWARDED_FOR to REMOTE_ADDR.