Is it possible to spoof the last proxy of an X-Forwarded-For Header?

Question

I'm using a firefox plugin https://addons.mozilla.org/en-US/firefox/addon/x-forwarded-for-header/ to spoof the X-Forwarded-For Header to 8.8.8.8.

For the following php page:

echo $_SERVER['REMOTE_ADDR']  . '<br />'; 
echo $_SERVER['HTTP_X_FORWARDED_FOR']  . '<br/>' . '<br />'; 

When accessing the instance from the instance ip address this is the following output:

72.14.255.255
8.8.8.8

When accessing the instance from the load balancer address that the instance is in, this is the following output:

10.173.25.72
8.8.8.8, 72.14.255.255

The first value is local ip of my elastic load balancer.

Since the format of the X-Forwarded-For header is like so http://en.wikipedia.org/wiki/X-Forwarded-For

X-Forwarded-For: client, proxy1, proxy2

Is it safe to assume that the last proxy cannot be spoofed?

Answer 1

The load balancer sets the 'most recent' part of the header.

As long as you trust the load balancer (and the connection between your server and the load balancer) to set the header as the IP address at the other end of its TCP connection, then you can trust that the last entry in the header is an accurate representation of the source of the connection (from the load balancer's perspective).