使用全局URL访问页面时，为什么用户的IP是本地IP？

Question

I am logging every user's IP when they access the company's page.

There are two ways to access the page from inside the local network:

http://company/webpage

and

https://webpage.company.com

What bugs me is that even when the users use the https global IP, their accesses are still recorded on database with their IP as 10.50.1.12 or 10.50.1.100 .

Does that means that the browser or something else is redirecting the https://webpage.company.com to company/webpage ? Or does that mean that I'm using a flawed method to log the users IP?

Another way to ask my question (just to make sure I'm being clear): if I'm accessing my Internet web page from inside the LAN network, am I effectively going outside my network and then back? If not, where am I going wrong with my logging?

Code used to log user's IP:

user.LastIP = HttpContext.Current.Request.UserHostAddress;

I'm curious about this because I want to make sure the users inside the company will access the page using exclusively the LAN Network . The goal is to save bandwidth usage , which is scarce.

Edit:

Pinging the https://webpage.company.com from inside the LAN network will result in a reply from a global IP address like 194.xxx.xxx.xxx . So I'm clearly getting the user's IP wrongly. What would be the ideal way of retrieving the IP from the page accessing entity?

Answer 1

Access to http://company/webpage will result in a DNS lookup of the host name "company". To resolve this, DNS will need a fully qualified domain name (fqdn), so it will add a top level domain (according to the configured search list in the client). In this example, it seems fair to assume that the fqdn will be "company.com". This, in turn, may very well resolve to the same IP address as the "webpage.company.com". You can check this by using dns lookup utilities like 'nslookup' and 'dig', or simply by using 'ping company' and 'ping webpage.company.com'.

The users IP addresses you mention, 10.50.1.12 and 10.50.1.100, seems to be the local IP addresses of the client hosts. I base this assumption on the fact that these IP addresses come from the RFC-1918 address range which is used for internal addresses. My guess is that these are the correct IP addresses, and that your logging works fine.

The users IP address you will log from accessing ' http://company/webpage ' and ' https://webpage.company.com ' should in most cases be the same. You can see it this way: it doesn't matter what the target URL is, traffic is still coming from the same host, the same IP address.

In any case, you most probably don't need to worry about any traffic leaving your local network.