July, 2002

			Proxy Detection via PHP

The idea of detecting proxy servers has come to my mind while I wrote a PHP system that can block users from gaining access to certain parts of a Web site or an Intranet. The underlying mechanism is rather simple: the system has a file or a table in MySQL or Oracle, which contains the sub network or the IP address to block (example below). This file or table actually operates as an IP Access Restrictions list.

IP Access Restrictions:

	212.90.23.22
	123.22.11.222
	78.34.22.1
	67.44.*.*
	12.*.*.*

Of course, building such system is not a very complex problem, but the way to bypass such a system is much easier and requires no special techniques – just using a proxy server.

Here is where Proxy Detection System (PDS @ PHP) comes. If I block a user, he/she can just configure his/her web browser to use a proxy server while surfing on the net, and then he/she has access to my web site (ignoring the situation when the IP range of the proxy server falls among the IP Access Restrictions list). At this point you probably ask yourself 'How would it help me to know if the blocked user uses a proxy server?’ and the same question I asked myself while thinking about such a system. 

I found the answer after a couple of days of research (using some PHP references and Web master books), and now I'm going to explain it to you.

The System
------------------
Before explaining the code, I'll first discuss about what I used in my code.

$HTTP_X_FORWARDED_FOR

This argument plays a very important role in my code. This argument detects if the connection to the server is forwarded. Means, it checks to see if the user, requested a web page, is behind a proxy server. If it detects that the user is behind a proxy server, it returns his/her real IP Address, otherwise it returns NULL.

$REMOTE_ADDR

This argument detects the IP address of the user, who requested the web page from the server. Whether the user is behind a server or not it returns the IP Address of the computer where the request came from.

The Code
------------------
Here is the code for the proxy detection system; it was tested on Apache 1.3.24 on FreeBSD and Windows 2000:

<?php

echo "Starting Proxy Detection System<br><br>";

#Here you can call a function to check if the IP is blocked
#and if not then continue to the IF statement

if ($HTTP_X_FORWARDED_FOR)
{
	echo "Warring: You might be using a proxy server to connect us<br><br>";
	echo "Connected Via: " . $HTTP_VIA . " - " . $REMOTE_ADDR;
	echo "<br>Your real IP: " . $HTTP_X_FORWARDED_FOR; 
}
else
{
	echo "You are probably not using a proxy server<br>";
	echo "Your IP: " . $REMOTE_ADDR;
}

?>

Of course, the above piece of code has its own problems, and it doesn't work perfectly to avoid blocked users to gain access to web pages even if they use HTTP proxy. There are three major problems within the code:

Anonymous Proxy Servers

If a user gains access to your web site via an anonymous proxy server, then HTTP_X_FORWARDED_FOR will be empty because such proxy servers do not send HTTP_X_FORWARDED_FOR variable to host, this improves privacy since the IP address cannot be logged.

High Anonymity

HTTP proxy server of this type does not send HTTP_X_FORWARDED_FOR and
HTTP_VIA variables. This much improves privacy since host does not know you are using proxy server and, of course, it does not know your IP address.

Cache Errors

This error is very common because most of Internet Service Providers (mine for example) have a proxy server that loads the web site from its cache. In this case if you try to connect to a web page you have been there before, and this web page has a system to check if you connect via proxy server, it always will display a warning message that you use a proxy server.

An example of such error:

Starting Proxy Detection System
Warring: You might used a proxy server to connect us
Connected Via: 1.0 proxy2 (NetCache NetAPP/5.2.1R1D3) - 195.194.22.23
Your real IP: 195.194.22.23
	
Both IPs are the same, but because a proxy server (NetCache) is installed on the ISP, it shows you an error.

Final Word
--------------

In this small tutorial I explained how you could build very simple proxy detection system in PHP and how to implement it on your web site. Of course, there is NO way to find if a user is connected through a proxy or not, but still it does supply a small security for your web site. If you do want better security then you need to block also proxy servers' IP addresses, but still you cannot block the entire Internet from getting access to your web page.

Dr.T, admin@ebcvg.com
www.ebcvg.com