IPv4 vs IPv6 — API IP Whitelist Problem Ka Simple Guide - Coding Help

Aapne API banayi. Client ne call kiya. Aapne IP whitelist lagayi. Lekin:

Client ka IP IPv6 me aa raha hai, aur aapki whitelist me IPv4 hai. API kaam nahi kar rahi.

Ye article isi problem ka simple solution hai.

IPv6 to IPv4 Convert prcess ?

ek line me apako jawab du agar apake cloudflare used kar rahe hai, apane A record add kiya hoga usame Proxied orange color me proxy status me aisa hoga this domain se aap kabhi bhi ipv4 ip address get nahi kar sakate hai. apaka api konsa hosting se access ho raha hai.

agar apako har condition me ipv4 chahiye to apako cloudflare me proxy status me Proxied to DNS only me change karna hoga. aise karne se aap jo apaki api ko access karega curl php or other kisi bhi method se to aap uska ipv4 ip address get hoga always, aise karne se domain no secure ho jata hai ssl miss ho jata hai aise me aap apani hosting ke control panel se free ssl install kar sakate hai jisaase apaka website HTTPS ke sath open ho jayega. aisa liye hot ahai kyuki cloudflare ipv6 ko prefer karta hai aap isako disabled bhi nahi kar sakte hai.

Dummy setup jo hum use karenge:

API Server: api.example.com (IP: 1.2.3.4)
Client A: client-a.com (IP: 5.6.7.8)
Client B: client-b.com (IP: 9.10.11.12)

Part 1: IP Address Kya Hota Hai?

Internet pe har device ko ek address milta hai — jaise ghar ka address.

Do Types:

Type	Example	Format
IPv4	`1.2.3.4`	4 numbers, dots se
IPv6	`2001:db8::1`	8 groups, colons se

Dono abhi saath me chalte hain. Isko dual-stack kehte hain.

Part 2: IPv4 Kaise Get Karein?

Server Pe Command Se:

# Sirf IPv4
curl -4 ifconfig.me
# Output: 1.2.3.4

# Sirf IPv6
curl -6 ifconfig.me
# Output: 2001:db8::1

# Default (jo pehle mile)
curl ifconfig.me

PHP Se:

<?php
// Server ka outbound IPv4
$ipv4 = file_get_contents('https://api.ipify.org');
echo "Server IPv4: $ipv4\n";   // 1.2.3.4

// Client ka IP (jo API call kar raha hai)
$clientIp = $_SERVER['REMOTE_ADDR'];
echo "Client IP: $clientIp\n";

Part 3: IPv6 Ko IPv4 Me Convert — Sach Kya Hai?

⚠️ Important Baat:

Pure IPv6 ko IPv4 me convert NAHI kar sakte. Ye do alag protocols hain.

Lekin ek special case hai — IPv4-Mapped IPv6:

::ffff:5.6.7.8     ← Ye actually IPv4 hi hai, IPv6 format me wrapped

Isme se 5.6.7.8 nikal sakte ho.

PHP Code:

<?php
function fixIp($ip) {
    // Agar ::ffff:5.6.7.8 type hai
    if (preg_match('/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i', $ip, $m)) {
        return $m[1];   // 5.6.7.8
    }
    return $ip;   // As-is
}

echo fixIp('::ffff:5.6.7.8');     // 5.6.7.8
echo fixIp('2001:db8::1');        // 2001:db8::1 (unchanged)

Pure IPv6 (2001:db8::1) ka koi IPv4 version nahi hota — ise aap reject karo ya whitelist me add karo.

Part 4: `CURLOPT_IPRESOLVE` — Kab Use Karein?

Ye Kya Karta Hai?

Jab cURL kisi domain ko call karta hai, wo DNS se IP leke connect karta hai. Default me IPv6 pehle try karta hai.

CURLOPT_IPRESOLVE se force karo — sirf IPv4.

Complete Example (Client Side):

<?php
// Client-a.com ka code
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, 'https://api.example.com/test.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// ✅ IPv4 force karo
curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);

$response = curl_exec($ch);

if (curl_errno($ch)) {
    echo 'Error: ' . curl_error($ch);
} else {
    echo $response;
}

curl_close($ch);

Kab Use Karein?

Situation	Use?
API server IPv6 me aayega, whitelist IPv4 hai	✅ Haan
Client-side pe control hai	✅ Haan
Client-side pe control nahi	❌ Server-side fix karo

⚠️ Limitation: Ye client side ka fix hai. Har client ko bolna practical nahi.

Part 5: Cloudflare Me IPv6 Kyun Aata Hai?

Setup:

Client (5.6.7.8) ──► Cloudflare ──► Aapka Server (api.example.com)

Aapko Dikhta Hai:

echo $_SERVER['REMOTE_ADDR'];
// Output: 2001:db8::cafe   ← IPv6 (Cloudflare ka)

Lekin aapki whitelist me IPv4 hai:

$whitelist = ['5.6.7.8', '9.10.11.12'];
// ↑ Fail

3 Reasons:

1. Cloudflare IPv6 Compatibility ON hai

Default ON hoti hai
Free plan pe disable nahi kar sakte (Enterprise only)

2. Client dual-stack hai

Modern clients IPv6 pehle try karte hain

3. REMOTE_ADDR = Cloudflare ka IP

Client ka nahi!
Ye sabse important point hai

Real Client IP Kaise Lein:

<?php
$clientIp = $_SERVER['HTTP_CF_CONNECTING_IP']   // ✅ Cloudflare header
         ?? $_SERVER['REMOTE_ADDR'];             // Fallback

CF-Connecting-IP header me asli client IP hota hai!

Part 6: Solutions — 3 Simple Options

✅ Solution 1: Cloudflare Grey Cloud (Sabse Simple)

Kya karo:

Cloudflare → DNS → Records
api.example.com ke aage orange cloud 🟠 → grey cloud ⚪ (DNS Only) karo
Save

Kya hoga:

Client (5.6.7.8) ──► Aapka Server directly (1.2.3.4)
                          │
                          └─ REMOTE_ADDR = 5.6.7.8 ✅

Code simple:

<?php
$clientIp = $_SERVER['REMOTE_ADDR'];   // Direct client ka IP

$whitelist = ['5.6.7.8', '9.10.11.12', '1.2.3.4'];

if (!in_array($clientIp, $whitelist, true)) {
    http_response_code(403);
    echo json_encode(['error' => 'IP not whitelisted', 'your_ip' => $clientIp]);
    exit;
}

echo json_encode(['status' => 'success', 'your_ip' => $clientIp]);

Trade-off: Cloudflare DDoS protection off ho jayega. Firewall zaroor lagao.

✅ Solution 2: Cloudflare Rakho + `CF-Connecting-IP` Use Karo

Cloudflare proxy ON rakho (orange cloud), lekin code me header use karo:

<?php
function getRealClientIp() {
    // Cloudflare ka real client IP
    if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        return $_SERVER['HTTP_CF_CONNECTING_IP'];
    }
    return $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
}

$clientIp = getRealClientIp();

// IPv6-mapped IPv4 fix karo
if (preg_match('/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i', $clientIp, $m)) {
    $clientIp = $m[1];
}

// IPv6 clients reject karo
if (filter_var($clientIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
    http_response_code(403);
    echo json_encode([
        'error'   => 'IPv6 not allowed. Use IPv4.',
        'your_ip' => $clientIp,
    ]);
    exit;
}

// Whitelist check
$whitelist = ['5.6.7.8', '9.10.11.12', '1.2.3.4'];

if (!in_array($clientIp, $whitelist, true)) {
    http_response_code(403);
    echo json_encode(['error' => 'IP not whitelisted', 'your_ip' => $clientIp]);
    exit;
}

echo json_encode(['status' => 'success', 'your_ip' => $clientIp]);

Trade-off: Code me complexity, lekin Cloudflare ka DDoS + WAF milta hai.

✅ Solution 3: API Key + IP Dono Check Karo (Best)

Long-term best solution:

<?php
$clients = [
    'KEY_ABC123' => [
        'name' => 'Client A',
        'ip'   => '5.6.7.8',
    ],
    'KEY_XYZ789' => [
        'name' => 'Client B',
        'ip'   => '9.10.11.12',
    ],
];

$apiKey = $_SERVER['HTTP_X_API_KEY'] ?? '';
$clientIp = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'];

// API key check
if (!isset($clients[$apiKey])) {
    http_response_code(401);
    exit(json_encode(['error' => 'Invalid API key']));
}

// IP check
if ($clients[$apiKey]['ip'] !== $clientIp) {
    http_response_code(403);
    exit(json_encode([
        'error'   => 'IP mismatch',
        'your_ip' => $clientIp,
    ]));
}

echo json_encode([
    'status' => 'success',
    'client' => $clients[$apiKey]['name'],
]);

Client side:

curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-API-Key: KEY_ABC123',
]);

Part 7: Complete Example — Step by Step

Scenario:

API Server: api.example.com (IP: 1.2.3.4)
Client A: client-a.com (IP: 5.6.7.8)
Cloudflare: ON (orange cloud)

Step 1: Problem Check Karo

<?php
// debug.php — API server pe
echo "REMOTE_ADDR: " . $_SERVER['REMOTE_ADDR'] . "\n";
echo "CF-Connecting-IP: " . ($_SERVER['HTTP_CF_CONNECTING_IP'] ?? 'n/a') . "\n";

Output:

REMOTE_ADDR: 2001:db8::cafe       ← Cloudflare ka IPv6
CF-Connecting-IP: 5.6.7.8         ← ✅ Real client IPv4

Conclusion: CF-Connecting-IP use karo!

Step 2: Final Code (test.php)

<?php
header('Content-Type: application/json');

// 1. Real client IP nikalo
$clientIp = $_SERVER['HTTP_CF_CONNECTING_IP']   // Cloudflare
         ?? $_SERVER['REMOTE_ADDR'];

// 2. IPv6-mapped IPv4 fix karo
if (preg_match('/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i', $clientIp, $m)) {
    $clientIp = $m[1];
}

// 3. IPv6 clients reject karo
if (filter_var($clientIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
    http_response_code(403);
    echo json_encode([
        'status'  => 'error',
        'message' => 'IPv6 not allowed',
        'your_ip' => $clientIp,
    ]);
    exit;
}

// 4. Whitelist check
$whitelist = [
    '5.6.7.8',      // Client A
    '9.10.11.12',   // Client B
    '1.2.3.4',      // Khud ka server
];

if (!in_array($clientIp, $whitelist, true)) {
    http_response_code(403);
    echo json_encode([
        'status'  => 'error',
        'message' => 'IP not whitelisted',
        'your_ip' => $clientIp,
    ]);
    exit;
}

// 5. Success
echo json_encode([
    'status'  => 'success',
    'data'    => 'API response here',
    'your_ip' => $clientIp,
]);

Step 3: Client Side Code

<?php
// client-a.com/test_call.php
$ch = curl_init('https://api.example.com/test.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// IPv4 force karo
curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

Step 4: Expected Output

{
  "status": "success",
  "data": "API response here",
  "your_ip": "5.6.7.8"
}

✅ Kaam ho gaya!

Part 8: Quick Reference Table

Problem	Solution
Server ka IPv4 chahiye	`curl -4 ifconfig.me`
`::ffff:x.x.x.x` ko fix karna	`preg_match('/^::ffff:(\d+\.\d+\.\d+\.\d+)$/', $ip, $m)`
Pure IPv6 ko IPv4 banana	❌ Possible nahi — reject karo
Cloudflare pe real IP	`$_SERVER['HTTP_CF_CONNECTING_IP']`
cURL me IPv4 force	`curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4)`
Cloudflare IPv6 band	Grey cloud ya API se `ipv6: off`
Long-term solution	API Key + IP dono check

Part 9: Common Mistakes

❌ Mistake 1: `REMOTE_ADDR` Pe Bharosa Cloudflare Ke Saath

// ❌ Galat
$ip = $_SERVER['REMOTE_ADDR'];
// Output: 2001:db8::cafe (Cloudflare ka)

// ✅ Sahi
$ip = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'];
// Output: 5.6.7.8 (real client)

❌ Mistake 2: Sirf IPv4 Whitelist Me Rakhna

// ❌ Galat
$whitelist = ['5.6.7.8'];

// ✅ Sahi (ya IPv6 reject karo)
$whitelist = ['5.6.7.8', '2001:db8::1'];

❌ Mistake 3: Client Pe Force Karna

Client ko CURLOPT_IPRESOLVE use karne bolna practical nahi. Server side pe fix karo.

Part 10: Aaj Hi Ye Karo

Agar aap API owner ho:

✅ CF-Connecting-IP header use karo (Cloudflare ke saath)
✅ IPv6-mapped IPv4 ko normalize karo
✅ Pure IPv6 clients reject karo (ya whitelist me daalo)
✅ Long-term me API Key system introduce karo

Agar aap API consumer ho:

✅ curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4) use karo
✅ Apna server ka IPv4 API owner ko bhejo: curl -4 ifconfig.me
✅ API Key system maango (IP se better hai)

Conclusion

Ek line me:

IPv6 aur IPv4 do alag protocols hain. Pure IPv6 ko IPv4 me convert nahi kar sakte. IPv6-mapped IPv4 (::ffff:5.6.7.8) ko convert kar sakte ho. Cloudflare ke saath REMOTE_ADDR me Cloudflare ka IP aata hai — isliye HTTP_CF_CONNECTING_IP header use karo. Simple setup ke liye Cloudflare grey cloud karo. Long-term ke liye API Key + IP dono check karo.

ByCoding Help