That only works if the proxy is sitting on localhost or a local network, just setting the header shouldn't work.

(I came here because I was curious how jart got 127 and 10, but after seeing the source is their's that's less of wonder..)

bool IsPrivateIp(uint32_t x) {

  return (x >> 24) == 10                   /* 10.0.0.0/8  */

         || (x & 0xfff00000) == 0xac100000 /* 172.16.0.0/12  */

         || (x & 0xffff0000) == 0xc0a80000 /* 192.168.0.0/16  */;

the code doesn't consider 127.0.0.0/8 as "private". I'm curious about 10.0.0.0/8 though.*