merge

@@ -10,8 +10,9 @@ const captchaPolicy = require('./policies/captcha');
 const reporterPolicy = require('./policies/reporter');
 
 const IP_WHITE_LIST = [
-    // '106.38.38.146',
-    // '218.94.75.58'
+    '106.38.38.146',
+    '218.94.75.58',
+    '218.94.75.50'
 ];
 
 const limiter = (rule, policy, context) => {
@@ -19,13 +20,18 @@ const limiter = (rule, policy, context) => {
 };
 
 module.exports = (req, res, next) => {
-    let remoteIp = req.get('X-Forwarded-For') || req.connection.remoteAddress;
-    logger.debug('request remote ip: ', remoteIp);
+    let remoteIp = req.get('X-Forwarded-For') || req.get('X-Real-IP') || '';
 
     if (remoteIp.indexOf(',') > 0) {
         let arr = remoteIp.split(',');
 
-        remoteIp = arr[0];
+        remoteIp = arr[arr.length - 1];
+    }
+
+    remoteIp = _.trim(remoteIp);
+
+    if (_.startsWith(remoteIp, '10.66.')) {
+        remoteIp = req.get('X-Real-IP');
     }
 
     const excluded = _.includes(IP_WHITE_LIST, remoteIp);

@@ -22,6 +22,10 @@ module.exports = (req, res, next) => {
         return next();
     }
 
+    if (res.statusCode == 403) {
+        return res.end();
+    }
+
     if (req.xhr) {
         return res.json({
             code: 400,