I just migrated my LimeSurvey site and it is running with Apache2 behind nginx reverse proxy. nginx terminates the https SSL and uses plain http to Apache2/limesurvey.

I setup nginx with the proxy_set_header lines:
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

Digging around it looks like there is a function, getIPAddress() in limesurvey/application/helpers/common_helper.php that pays attention to the X-Forwarded-For header:

$sIPAddress = $_SERVER['HTTP_X_FORWARDED_FOR'];

However, the code that looks for FailedLoginAttempts, limesurvey/application/models/FailedLoginAttempt.php, uses this other getUserHostAddress stuff:

substr(Yii:app()->request->getUserHostAdress(),0,40)

getUserHostAddress()
$_SERVER'[REMOTE_ADDR']

To stop my users from all being locked out when one person gets locked out I tweaked: maxLoginAttempt / timeOutTime

Am I doing something wrong, or should FailedLoginAttempts be using getIPAddress()???

Thanks!