I have a Magento store on an Ngix behind Sucuri firewall and we hide prices if the IP is outside of UK.
A bruteforce attack was bypassing the firewall so the hosting added the following rules to prevent bypass:

 location / 
 allow 192.88.134.0/23;
 allow 185.93.228.0/22;
 allow 2a02:fe80::/29;
 allow 66.248.200.0/22;
 deny all;
 # Existing NGINX rules
 

This works fine except that all IPs are transalted as the firewall one based in UK. To get the real IP Sucuri suggested to add the following:

 # Define header with original client IP
 real_ip_header X-Forwarded-For;
 # Define trusted Firewall IPs
 set_real_ip_from 192.88.134.0/23;
 set_real_ip_from 185.93.228.0/22;
 set_real_ip_from 66.248.200.0/22;
 set_real_ip_from 2a02:fe80::/29; # this line can be removed if IPv6 is 
 disabled

This second rule causes a problem. Once the IP is translated and if it is different than the allowed Sucuri IP addresses, the requests is restricted with 403 Forbidden error.

Is it impossible to have the store behind a firewall and still get the real IP. I am sure that this is not the only store in the world behind a firewall, which needs to server different content depending on the IP.
The code in Magento that gets the IP of the client is something like this:

 $geoIP = Mage::getSingleton('geoip/country'); 

 if ($geoIP->isCountryAllowed()) {....

Any alternative? SOlution? My hosting provider is useless..

We hit the same issue, when trying to apply the suggested "Block Sucuri Bypass"

location / 
 # Block everything that isn't sucuri
 allow 192.88.134.0/23;
 allow 185.93.228.0/22;
 allow 2a02:fe80::/29;
 allow 66.248.200.0/22;
 deny all;

 # other nginx config

As this was below the already configured:

# Define header with original client IP
real_ip_header X-Forwarded-For;
# Define trusted IPs
set_real_ip_from 192.88.134.0/23;
set_real_ip_from 185.93.228.0/22;
set_real_ip_from 66.248.200.0/22;
set_real_ip_from 2a02:fe80::/29;

Magento 1

So long as the code uses the core method:

Mage::helper('core/http')->getRemoteAddr()

You can add a list of headers to app/etc/local.xml inside of config->global node that are used to determine the "real" ip. Something like:

<remote_addr_headers>
 <header1>HTTP_X_SUCURI_CLIENTIP</header1>
 <header2>HTTP_X_REAL_IP</header2>
 <header3>HTTP_X_FORWARDED_FOR</header3>
</remote_addr_headers>

Then you can remove the real_ip_header and set_real_ip_from from the nginx config. Allowing all traffic not from Sucuri to be blocked and still able to obtain the true IP within magento. You can test this with something like:

define('MAGENTO_ROOT', getcwd());
$mageFilename = MAGENTO_ROOT . '/app/Mage.php';
require MAGENTO_ROOT . '/app/bootstrap.php';
require_once $mageFilename;

Mage::app('admin');
print_r($_SERVER);
echo 'address: '.Mage::helper('core/http')->getRemoteAddr();

Magento 2

This appears to a little harder, I haven't dug as deep but on initial look.

- vendor/magento/framework/Session/Validator.php

is sensitive to configuration, on if it should use: http_x_forwarded_for or remote_addr

- vendor/magento/framework/HTTP/PhpEnvironment/Request.php:725

has the method getClientIp which appears to use the first it finds from HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, REMOTE_ADDR

- vendor/magento/magento2-base/pub/errors/processor.php:312

had the method _getClientIp which uses REMOTE_ADDR and if that isn't found returns undefined

I may be wrong but I haven't spotted anywhere a single value can be configured, or a list to try. So at this point would suggest adding something like the following to app/etc/bootstrap.php

$trustedIpHeaders = [
 'HTTP_X_SUCURI_CLIENTIP', 
 'HTTP_X_REAL_IP',
 'HTTP_X_FORWARDED_FOR',
];
$headersToPopulate = [
 'HTTP_CLIENT_IP',
 'HTTP_X_FORWARDED_FOR',
 'REMOTE_ADDR',
];
foreach($trustedIpHeaders as $trustedIpHeader)
 if(isset($_SERVER[$trustedIpHeader]))
 foreach($headersToPopulate as $headerToPopulate)
 $_SERVER[$headerToPopulate] = $_SERVER[$trustedIpHeader]
 
 break;
 

For all those who come across the same issue and try to get an answer from sucuri or hopeless hosting providers like siteground, this is what worked for me. I put the following code at the very beginning of Magento index.php:

if(isset($_SERVER['HTTP_X_SUCURI_CLIENTIP']))
 {
 $_SERVER["REMOTE_ADDR"] = $_SERVER['HTTP_X_SUCURI_CLIENTIP'];