Struggling with inconsistent public IP detection for users behind specific NAT configurations, any ideas?

hey folks,

i'm running a simple "What is my IP Address" web tool and mostly it works great. however, i've been noticing some really weird, inconsistent public IP detection issues for a subset of users, especially those behind complex NAT setups or corporate proxies.

• The Core Problem: users report seeing an incorrect IP, or sometimes even an internal IP, instead of their actual public IP address. it's not widespread, maybe 5-10% of requests, but it's enough to be annoying and degrade accuarcy.
• Specific Scenarios & Symptoms:
  • users behind carrier-grade NAT (CGNAT) often report a different external IP than what other services show.
  • some corporate VPN/proxy users get the proxy's IP, which is expected, but others get an internal network IP (which is definitely wrong for a public IP tool).
  • i've also seen discrepancies with IPv6-enabled networks where IPv4 is incorrectly reported or vice-versa.
• What I've Tried So Far:
  • checked standard HTTP headers like X-Forwarded-For, X-Real-IP, and Via.
  • used multiple server-side IP detection libraries (PHP's $_SERVER['REMOTE_ADDR'], python's request.remote_addr) and compared results.
  • even tried a client-side JavaScript AJAX call to a different endpoint just to compare, sometimes it matches, sometimes it doesn't.
  • ensured our load balancer (nginx) is correctly passing the real IP.
• Example of Inconsistent Log Output:

  [2024-07-26 14:35:12] INFO: Request from client IP: 192.168.1.10 (internal)
  [2024-07-26 14:35:12] WARNING: Detected public IP: 172.217.160.142 (Google's, likely proxy)
  [2024-07-26 14:35:13] INFO: User reported IP: 203.0.113.45 (their actual public IP)
  [2024-07-26 14:35:13] ERROR: IP Mismatch for session XYZ: client reported vs. server detected.

• My Main Questions:
  • what advanced network-level checks or server configurations could i be missing to accurately identify the *true* public IP for these edge cases?
  • are there specific headers or proxy settings i should be looking for that are common in complex NAT or enterprise enviroments?
  • any obscure HTTP headers or TCP/IP inspection methods that might help?

this is driving me a bit nuts, and i want to ensure the tool is as accurate as possible for everyone. help a brother out please...