Basic explanation for why I'm getting different IP addresses when querying for users IP W/without VPN?

Question

I'm trying to work out some basic knowledge of rate-limiting for my server security so I know how it works. Seems pretty simple as there are different algorithms as well as IP limiting methods. This is not what my question is about, I will be using packages in the end but, in playing around I have discovered:

If I google or use any search to check my IP i get my public address (VPN)

• Example: 198.8.92.83 (or whatever the VPN session address is) (not actual address)

I check my VPN address in my network settings

• Example: 10.11.3.2 (this seems to not change when VPN session is toggled) (not actual address)

My private address is never seen anywhere.

• Example: 188.177.3.88 (not actual address)

When I query for users IP with middleware on Parse Back4App I get

• Example: 10.4.44.234 (not actual address)

But this IP 4th number changes every request if my VPN is active or not

This is very confusing, if it's confusing to me (weather a beginner or not) how can an IP rate limiter/blacklister do an effective job when an IP is always changing? Question 1...

Question 2, why is my VPN address different than my IP from my request to my server?

What I'm using to get query address:

app.use(function(req, res, next) {
  req.headers['x-real-ip'] = req.ip;
  next();
});

Parse.Cloud.define('geoLookup', function(request, response) {
  var clientIP = request.headers['x-real-ip'];
});

Reference

Answer 1

You are not checking the users IP address in most cases here:

• my public address (VPN)
  is the IP address of the VPN endpoint. While it is unique on the internet it is shared with many other users using the same VPN.
• my VPN address in my network settings
  is the IP address of your machine in your local network. Usually this is an IP address in the private network range. It is not routable on the internet, not unique and is associated with different systems in different LAN.
• My private address
  is the IP address of your router or in case of CG-NAT some router in the infrastructure of your ISP. It is thus shared with other systems in your LAN or even with other users of the ISP.
• users IP with middleware on Parse Back4App
  looks like some IP address of an internal infrastructure, similar to your IP address in your local LAN. It is thus shared too.

None of these IP address can be used to uniquely identify a user. Some are internal IP only and can not be used at all, others usually represent multiple machines. Apart from that the VPN exit and the IP allocated by the ISP are often dynamic, i.e. they can change over time.

Which means relying on the IP address to identify a specific user on the internet is not a good idea in the first place. Any rate limiting or black listing will only work for a short term and can often be easily explicitly bypassed by reconnecting to the ISP or by using a different VPN endpoint. Additionally there is a risk of overblocking, i.e. of blocking other users behind the same IP address. As long as one is aware of these limitations it might be used as a short term mitigation against attacks, but not as a reliable long term prevention method.