diff --git a/conf/config.ini b/conf/config.ini
index e836a124..49533769 100644
--- a/conf/config.ini
+++ b/conf/config.ini
@@ -204,10 +204,13 @@ dirMenu=1
 #访问 http://127.0.0.1/app_b/file_b 对应的文件路径为 /path/to/b/file_b
 #访问其他http路径,对应的文件路径还是在rootPath内
 virtualPath=
-#禁止后缀的文件缓存，使用“,”隔开
+#禁止后缀的文件使用mmap缓存，使用“,”隔开
 #例如赋值为 .mp4,.flv
 #那么访问后缀为.mp4与.flv 的文件不缓存
 forbidCacheSuffix=
+#可以把http代理前真实客户端ip放在http头中：https://github.com/ZLMediaKit/ZLMediaKit/issues/1388
+#切勿暴露此key，否则可能导致伪造客户端ip
+forwarded_ip_header=
 
 [multicast]
 #rtp组播截止组播ip地址
diff --git a/src/Common/config.cpp b/src/Common/config.cpp
index ae1593bf..1b775141 100644
--- a/src/Common/config.cpp
+++ b/src/Common/config.cpp
@@ -124,6 +124,7 @@ const string kVirtualPath = HTTP_FIELD "virtualPath";
 const string kNotFound = HTTP_FIELD "notFound";
 const string kDirMenu = HTTP_FIELD "dirMenu";
 const string kForbidCacheSuffix = HTTP_FIELD "forbidCacheSuffix";
+const string kForwardedIpHeader = HTTP_FIELD "forwarded_ip_header";
 
 static onceToken token([]() {
     mINI::Instance()[kSendBufSize] = 64 * 1024;
@@ -150,6 +151,7 @@ static onceToken token([]() {
                                                 "</html>"
                                              << endl;
     mINI::Instance()[kForbidCacheSuffix] = "";
+    mINI::Instance()[kForwardedIpHeader] = "";
 });
 
 } // namespace Http
diff --git a/src/Common/config.h b/src/Common/config.h
index ad87247e..787a1fe2 100644
--- a/src/Common/config.h
+++ b/src/Common/config.h
@@ -223,6 +223,8 @@ extern const std::string kNotFound;
 extern const std::string kDirMenu;
 // 禁止缓存文件的后缀
 extern const std::string kForbidCacheSuffix;
+// 可以把http代理前真实客户端ip放在http头中：https://github.com/ZLMediaKit/ZLMediaKit/issues/1388
+extern const std::string kForwardedIpHeader;
 } // namespace Http
 
 ////////////SHELL配置///////////
diff --git a/src/Http/HttpSession.cpp b/src/Http/HttpSession.cpp
index 6b9b7972..c90544b3 100644
--- a/src/Http/HttpSession.cpp
+++ b/src/Http/HttpSession.cpp
@@ -670,6 +670,11 @@ bool HttpSession::emitHttpEvent(bool doInvoke){
     return consumed;
 }
 
+std::string HttpSession::get_peer_ip() {
+    GET_CONFIG(string, forwarded_ip_header, Http::kForwardedIpHeader);
+    return forwarded_ip_header.empty() ? TcpSession::get_peer_ip() : _parser.getHeader()[forwarded_ip_header];
+}
+
 void HttpSession::Handle_Req_POST(ssize_t &content_len) {
     GET_CONFIG(size_t,maxReqSize,Http::kMaxReqSize);
 
diff --git a/src/Http/HttpSession.h b/src/Http/HttpSession.h
index d78dcdc4..6f5bebdf 100644
--- a/src/Http/HttpSession.h
+++ b/src/Http/HttpSession.h
@@ -97,6 +97,9 @@ protected:
      */
     void onWebSocketDecodeComplete(const WebSocketHeader &header_in) override;
 
+    //重载获取客户端ip
+    std::string get_peer_ip() override;
+
 private:
     void Handle_Req_GET(ssize_t &content_len);
     void Handle_Req_GET_l(ssize_t &content_len, bool sendBody);