For some reasons all users (as it seems) are making all changes from the server IP, like in logs all users have the same adress, and thats actually my server IP address. Don't really understand, why.
/xff works fine, but still thats does not seems right